Bug bounty program · HackerOne
Revive Adserver
Most upvoted reports61
- #3395221ValidError-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0Revive Adserver · SQL Injection · 2025 · High–93votes
- #3434156ValidUsername Validation BypassRevive Adserver · Authentication · 2025 · Medium–64votes
- #3401612ValidIDOR Vulnerability in Banner DeletionRevive Adserver · Insecure Direct Object Reference · 2025 · High–56votes
- #3091390ValidReflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2Revive Adserver · Cross-site Scripting · 2025 · Medium–49votes
- #3653196ValidBlind SQL injection via clientid parameter in zone‑include.phpRevive Adserver · SQL Injection · 2026 · High–49votes
- #96115ValidLogin page password-guessing attackRevive Adserver · Misconfiguration and Insecure Design · 2024–47votes
- #3445710ValidBroken Access Control allows advertiser accounts to delete trackers they do not ownRevive Adserver · Access Control · 2026 · High–47votes
- #3781492ValidPHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingRevive Adserver · Command and Code Injection · 2026 · High–46votes
- #3650504ValidMissing access control when linking banners or campaigns to zonesRevive Adserver · Access Control · 2026 · Medium–42votes
- #3470970ValidReflected XSS in banner-acl.php and channel-acl.php via executionorderRevive Adserver · Cross-site Scripting · 2026 · Medium–39votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.