CVE-2026-21664: XSS
HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21664?
CVE-2026-21664 is a reflected XSS vulnerability that poses a significant risk to logged-in administrators of Revive Adserver.
How do I fix CVE-2026-21664?
To fix CVE-2026-21664, ensure that input validation and output encoding are properly implemented in the afr.php delivery script of Revive Adserver.
Who is affected by CVE-2026-21664?
CVE-2026-21664 affects administrators who are logged into Revive Adserver and could be tricked into visiting a malicious URL.
What type of vulnerability is CVE-2026-21664?
CVE-2026-21664 is classified as a reflected cross-site scripting (XSS) vulnerability.
Can CVE-2026-21664 be exploited remotely?
Yes, CVE-2026-21664 can be exploited remotely by an attacker crafting a specific URL designed to execute malicious HTML on an administrator's session.