PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50745 Revive CVE debrief

CVE-2026-50745 is a medium-severity vulnerability in Revive Adserver, a popular open-source ad server. The vulnerability exists due to a missing sanitisation in the stats-video.php script, allowing user-supplied input to be reflected without escaping. This could potentially lead to Cross-Site Scripting (XSS) attacks. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.1, indicating a moderate level of severity. The vulnerability was published on June 26, 2026, and last modified on June 29, 2026.

Vendor
Revive
Product
Adserver
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Administrators and users of Revive Adserver should be aware of this vulnerability and take necessary steps to mitigate it. This vulnerability could potentially be exploited by attackers to inject malicious scripts into the application, leading to unauthorized actions or data breaches. Organizations using Revive Adserver should prioritize patching this vulnerability to prevent potential attacks.

Technical summary

The vulnerability exists in the stats-video.php script of Revive Adserver, where user input is not properly sanitised. The Smarty custom helper function url is used to construct URLs, but its output is neither properly encoded nor sanitised. This allows an attacker to inject malicious scripts, potentially leading to Cross-Site Scripting (XSS) attacks. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability can be exploited remotely, requires no user interaction, and has a moderate impact on confidentiality and integrity.

Defensive priority

Patching this vulnerability should be a high priority for administrators of Revive Adserver. The vulnerability can be mitigated by applying the necessary patches or updates to the stats-video.php script.

Recommended defensive actions

  • Apply patches or updates to the stats-video.php script to fix the sanitisation issue.
  • Review and update the Smarty custom helper function url to ensure proper encoding and sanitisation of user input.
  • Implement additional security measures, such as input validation and output encoding, to prevent similar vulnerabilities.
  • Monitor the application for suspicious activity and implement logging and auditing to detect potential attacks.
  • Consider implementing a Web Application Firewall (WAF) to detect and prevent XSS attacks.

Evidence notes

The vulnerability was reported by an anonymous researcher through HackerOne. The CVE record and NVD detail pages provide additional information about the vulnerability, including its CVSS score and vector.

Official resources

This article is AI-assisted and based on the supplied source corpus.