CVE-2026-21663: XSS
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21663?
CVE-2026-21663 is classified as a reflected cross-site scripting (XSS) vulnerability, which has a moderate severity level.
How do I fix CVE-2026-21663?
To fix CVE-2026-21663, always validate and sanitize user inputs in the banner-acl.php script to prevent execution of malicious HTML code.
Who is affected by CVE-2026-21663?
CVE-2026-21663 affects installations of Revive Adserver where administrators can be tricked into clicking crafted URLs.
Can CVE-2026-21663 be exploited remotely?
Yes, CVE-2026-21663 can be exploited remotely by an attacker crafting a malicious URL that tricks a logged-in administrator.
What are the potential impacts of CVE-2026-21663?
The potential impacts of CVE-2026-21663 include unauthorized access to administrative privileges and the execution of malicious scripts in the context of the administrator's browser.