CVE-2026-21642

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://hackerone.com/reports/3470970	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:18

Type	Values Removed	Values Added
Summary		(es) El miembro de la comunidad de HackerOne Patrick Lang (7yr) ha reportado una vulnerabilidad de XSS reflejado en los scripts 'banner-acl.php' y 'channel-acl.php' de Revive Adserver. Un atacante puede crear una URL específica que incluye una carga útil HTML en un parámetro. Si un administrador con sesión iniciada visita la URL, el HTML se envía al navegador y se ejecutarían scripts maliciosos.

30 Jan 2026, 20:14

Type	Values Removed	Values Added
First Time		Aquaplatform Aquaplatform revive Adserver
References	~~() https://hackerone.com/reports/3470970 -~~	() https://hackerone.com/reports/3470970 - Third Party Advisory
CPE		cpe:2.3:a:aquaplatform:revive_adserver::::::::

21 Jan 2026, 21:16

Type	Values Removed	Values Added
CWE		CWE-79

20 Jan 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-20 21:16

Updated : 2026-06-17 10:18

NVD link : CVE-2026-21642

Mitre link : CVE-2026-21642

CVE.ORG link : CVE-2026-21642

JSON object : View

Products Affected

aquaplatform

revive_adserver

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-21642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21642", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T20:47:02.677630Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Revive", "product": "Revive Adserver", "versions": [{"status": "affected", "version": "6", "versionType": "semver", "lessThanOrEqual": "6.0.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-20T21:16:06.310", "references": [{"url": "https://hackerone.com/reports/3470970", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed."}, {"lang": "es", "value": "El miembro de la comunidad de HackerOne Patrick Lang (7yr) ha reportado una vulnerabilidad de XSS reflejado en los scripts 'banner-acl.php' y 'channel-acl.php' de Revive Adserver. Un atacante puede crear una URL espec\u00edfica que incluye una carga \u00fatil HTML en un par\u00e1metro. Si un administrador con sesi\u00f3n iniciada visita la URL, el HTML se env\u00eda al navegador y se ejecutar\u00edan scripts maliciosos."}], "lastModified": "2026-06-17T10:18:51.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB1E6D97-42AD-4A1B-89B3-86356A4B5E59", "versionEndIncluding": "6.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}