Reflected XSS Vulnerability in Revive Adserver

CVE-2026-50740

What is CVE-2026-50740?

A reflected XSS vulnerability exists in the zone-include.php script of Revive Adserver versions 6.0.7 and earlier. This weakness arises from a lack of proper input sanitization in the 'refresh' parameter of the iFrame invocation tag. An attacker can exploit this flaw by crafting a malicious iFrame that allows low-privileged users to execute arbitrary JavaScript in the context of the victim's browser. This could lead to unauthorized actions and exposure of sensitive information. Proper measures should be taken to ensure all user inputs are adequately sanitized to mitigate such risks.

References