Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
[revive-adserver] Reflected XSS in Banner Delivery Options via cap parameterAnalysed#3473696	Valid	Cross-site Scripting	Medium	2026-01-14	–	37
Reflected XSS in banner-acl.php and channel-acl.php via executionorderAnalysed#3470970	Valid	Cross-site Scripting	Medium	2026-01-14	–	39
Missing access control when linking banners or campaigns to zonesAnalysed#3650504	Valid	Access Control	Medium	2026-06-03	–	42
PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingAnalysed#3781492	Valid	Command and Code Injection	High	2026-06-25	–	46
Login page password-guessing attackAnalysed#96115	Valid	Misconfiguration and Insecure Design	–	2024-04-19	–	47
Broken Access Control allows advertiser accounts to delete trackers they do not ownAnalysed#3445710	Valid	Access Control	High	2026-01-14	–	47
Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2Analysed#3091390	Valid	Cross-site Scripting	Medium	2025-10-22	–	49
Blind SQL injection via clientid parameter in zone‑include.phpAnalysed#3653196	Valid	SQL Injection	High	2026-06-03	–	49
IDOR Vulnerability in Banner DeletionAnalysed#3401612	Valid	Insecure Direct Object Reference	High	2025-11-19	–	56
Username Validation BypassAnalysed#3434156	Valid	Authentication	Medium	2025-11-26	–	64
Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0Analysed#3395221	Valid	SQL Injection	High	2025-10-24	–	93

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.