CVE-2026-21663

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://hackerone.com/reports/3473696	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:18

Type	Values Removed	Values Added
Summary		(es) El miembro de la comunidad de HackerOne Patrick Lang (7yr) ha informado de una vulnerabilidad de XSS reflejado en el script banner-acl.php de Revive Adserver. Un atacante puede crear una URL específica que incluye una carga útil HTML en un parámetro. Si un administrador con sesión iniciada visita la URL, el HTML se envía al navegador y los scripts maliciosos se ejecutarían.

03 Feb 2026, 21:05

Type	Values Removed	Values Added
CPE		cpe:2.3:a:aquaplatform:revive_adserver::::::::
First Time		Aquaplatform Aquaplatform revive Adserver
References	~~() https://hackerone.com/reports/3473696 -~~	() https://hackerone.com/reports/3473696 - Third Party Advisory

21 Jan 2026, 21:16

Type	Values Removed	Values Added
CWE		CWE-79

20 Jan 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-20 21:16

Updated : 2026-06-17 10:18

NVD link : CVE-2026-21663

Mitre link : CVE-2026-21663

CVE.ORG link : CVE-2026-21663

JSON object : View

Products Affected

aquaplatform

revive_adserver

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-21663", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21663", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T20:41:47.623291Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Revive", "product": "Revive Adserver", "versions": [{"status": "affected", "version": "6", "versionType": "semver", "lessThanOrEqual": "6.0.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-20T21:16:06.443", "references": [{"url": "https://hackerone.com/reports/3473696", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed."}, {"lang": "es", "value": "El miembro de la comunidad de HackerOne Patrick Lang (7yr) ha informado de una vulnerabilidad de XSS reflejado en el script banner-acl.php de Revive Adserver. Un atacante puede crear una URL espec\u00edfica que incluye una carga \u00fatil HTML en un par\u00e1metro. Si un administrador con sesi\u00f3n iniciada visita la URL, el HTML se env\u00eda al navegador y los scripts maliciosos se ejecutar\u00edan."}], "lastModified": "2026-06-17T10:18:53.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AA08D1C-3638-4E0D-AC58-A8527E77536F", "versionEndIncluding": "6.0.4", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}