Reflected XSS Vulnerability in Revive Adserver by Revive Adserver Team

CVE-2026-21663

What is CVE-2026-21663?

A reflected XSS vulnerability exists in the banner-acl.php script of Revive Adserver, reported by HackerOne community member Patrick Lang. This issue allows attackers to concoct a specially crafted URL containing an HTML payload. If an administrator, who is currently logged in, accesses the malicious URL, the HTML code is executed in the browser, leading to the execution of hostile scripts. This poses a significant risk as it could allow unauthorized actions to be performed under the guise of the administrator's privileges.

References