Open redirect in ck.php and lg.php #1081406 Valid Open Redirect – 2021-01-20 – 2 Open redirect in switch account functionality #390663 Valid Open Redirect – 2019-04-23 – 3 Deserialization of Untrusted Data in www/delivery/adxmlrpc.php #512076 Valid Deserialization and Object Injection – 2019-04-23 – 4 Cross Site Scripting and Open Redirect in affiliate-preview.php file #819362 Valid Open Redirect – 2021-01-20 – 4 Banner status override by advertiser‑level users #3678828 Valid Access Control Medium 2026-06-03 – 5 Reflected XSS in Step 2 of the Installation #170156 Valid Cross-site Scripting – 2017-08-02 – 6 Reflected XSS on Zones > Invocation Code #178611 Valid Cross-site Scripting – 2017-08-02 – 7 Open redirection bypass in /www/admin/campaign-modify.php #794144 Valid Open Redirect – 2020-03-12 – 7 Reflected XSS on /admin/campaign-zone-zones.php #1097979 Valid Cross-site Scripting – 2021-03-16 – 7 Missing access control when modifying parent entities via XML‑RPC #3677576 Valid Access Control Medium 2026-06-03 – 7 Session ID reuse allowing XML‑RPC API authentication bypass #3672641 Valid Authentication Medium 2026-06-03 – 8 Reflected XSS on /admin/stats.php #1097217 Valid Cross-site Scripting – 2021-03-16 – 9 Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser #3680090 Valid Cross-site Scripting None 2026-06-03 – 9 Stored XSS on Admin Access Page - Email field #173501 Valid Cross-site Scripting – 2017-08-02 – 10 Deserialization of Untrusted Data in www/delivery/dxmlrpc.php #542670 Valid Deserialization and Object Injection – 2019-04-23 – 11 PHP code injection via unexpected delivery limitation parameter #3744200 Valid Command and Code Injection High 2026-06-03 – 11 Reflected XSS on /admin/stats.php #1187820 Valid Cross-site Scripting – 2021-06-03 – 12 Reflected XSS in stats‑video.php via improperly encoded URL parameters #3793243 Valid Cross-site Scripting Medium 2026-06-25 – 12 Use of a Broken or Risky Cryptographic Algorithm #1306942 Valid Cryptography – 2021-09-15 – 15 Reflected XSS on www/delivery/afr.php #775693 Valid Cross-site Scripting – 2020-01-21 – 16 Reflected XSS on /www/delivery/afr.php (bypass of report #775693) #986365 Valid Cross-site Scripting – 2021-01-19 – 16 Information Disclosure via “Add user” lookup in Account Management (User Access) #3401464 Valid Information Disclosure Medium 2025-11-19 – 16 Weak Forgot Password implementation #176116 Valid Authentication – 2017-08-02 – 17 Stored XSS on inventory-retrieve.php #3399809 Valid Cross-site Scripting Low 2025-11-19 – 17 Information Disclosure via Verbose Error Messages #3403450 Valid Information Disclosure Medium 2025-11-19 – 17 Reflected XSS in /admin/banner-zone.php (v6.0.0+) #3403727 Valid Cross-site Scripting Medium 2025-11-19 – 18 INI Format string injection in Revive Adserver 6.0.4 settings #3445332 Valid Memory Corruption Low 2026-01-14 – 19 Reflected XSS on /admin/userlog-index.php #1083231 Valid Cross-site Scripting – 2021-01-26 – 20 CSRF in zone‑include.php allows unauthorized banner and campaign linking #3781691 Valid Cross-Site Request Forgery Medium 2026-06-25 – 20 Reflected XSS in account-preferences-plugin.php #3399191 Valid Cross-site Scripting Medium 2025-11-19 – 21 Stored-XSS in Banner Name field #3404968 Valid Cross-site Scripting Low 2025-11-19 – 21 Stored XSS via Full Name field in userlog email entries #3669623 Valid Cross-site Scripting Medium 2026-06-03 – 21 bypass old password with array in /admin/account-user-email.php #792895 Valid Memory Corruption – 2020-03-12 – 22 Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval #3413890 Valid Denial of Service Medium 2025-11-19 – 22 Missing ownership validation allows cross‑manager tracker–campaign linking #3780709 Valid Insecure Direct Object Reference Medium 2026-06-25 – 22 Reflected XSS on /admin/stats.php #1083376 Valid Cross-site Scripting – 2021-01-26 – 24 Improper sanitisation of input in the settings could cause DoS #3399218 Valid Input Validation and Logic Low 2025-11-19 – 24 Stored XSS in maintenance tools via unescaped entity names #3781311 Valid Cross-site Scripting Medium 2026-06-25 – 25 Reflected XSS via clientid parameter in zone‑include.php #3653316 Valid Cross-site Scripting Medium 2026-06-03 – 26 Stored XSS in Conversion Statistics via Tracker Name #3400506 Valid Cross-site Scripting High 2025-11-19 – 28 Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation) #3413764 Valid Injection and Smuggling Medium 2025-11-19 – 28 XML‑RPC login leak exposes valid session ID enabling unauthorized API access #3783738 Valid Access Control Medium 2026-06-25 – 28 Reflected XSS via unsanitised refresh parameter in zone invocation tag #3780806 Valid Cross-site Scripting Medium 2026-06-25 – 29 Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php: #576504 Valid Authentication – 2019-05-21 – 31 Stored-XSS in campaign name displayed in Banners modal #3411750 Valid Cross-site Scripting Medium 2025-11-19 – 32 Authorization bypass allows changing email address of other users #3398283 Valid Access Control High 2025-11-19 – 35 Missing access control when linking trackers to campaigns #3650582 Valid Access Control Medium 2026-06-03 – 35 PHP code injection in delivery-limitation `logical` validation bypass #3780854 Valid Command and Code Injection High 2026-06-25 – 35 Reflected XSS in afr.php #3468169 Valid Cross-site Scripting Medium 2026-01-14 – 36 PHP code injection via delivery limitation logical #3656781 Valid Command and Code Injection High 2026-06-03 – 36