PT-2026-51554 · Revive Adserver · Revive Adserver

0X4C616E · Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-34916

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-34916

Produtos afetados

Revive Adserver

Referências · 2

• https://hackerone.com/reports/3656781 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34916 · Nota de Segurança