CVE-2026-21642: XSS
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php and channel-acl.php scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21642?
CVE-2026-21642 is classified as a reflected XSS vulnerability, which can allow attackers to execute arbitrary scripts in the context of an administrator's session.
How do I fix CVE-2026-21642?
To fix CVE-2026-21642, ensure that the `banner-acl.php` and `channel-acl.php` scripts properly validate and sanitize user inputs.
Which versions of Revive Adserver are affected by CVE-2026-21642?
CVE-2026-21642 affects all versions of Revive Adserver where the vulnerable scripts are present.
Can CVE-2026-21642 lead to unauthorized access?
Yes, if exploited, CVE-2026-21642 can allow an attacker to execute scripts that may lead to unauthorized access or data leakage.
What are the potential impacts of CVE-2026-21642?
The potential impacts of CVE-2026-21642 include session hijacking, data theft, and alteration of administrative settings.