Revive vulnerabilities
We track 8 vulnerabilities in Revive products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Revive vulnerabilities
- 8.8 High severity
Adserver: Improper Neutralization of Special Elements used in an SQL Command
Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database querie
- 8.1 High severity
Adserver: Authorization Bypass Through User-Controlled Key
An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, w
- 8.8 High severity
Adserver: Improper Control of Generation of Code
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RP
- 8.8 High severity
Adserver: Improper Control of Generation of Code
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would the
- 8.3 High severity
Adserver: Improper Neutralization of Special Elements used in an SQL Command
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all
- 8.8 High severity
Revive Adserver: Improper Access Control
Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.
- 8.8 High severity
Revive Adserver: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users
- 7.5 High severity
Adserver: Improper Restriction of Excessive Authentication Attempts
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features.