Open redirect in ck.php and lg.php #1081406 Valid Open Redirect Medium 2021-01-20 – 2 Banner status override by advertiser‑level users #3678828 Valid Access Control Medium 2026-06-03 – 5 Reflected XSS on /admin/campaign-zone-zones.php #1097979 Valid Cross-site Scripting Medium 2021-03-16 – 7 Missing access control when modifying parent entities via XML‑RPC #3677576 Valid Access Control Medium 2026-06-03 – 7 Session ID reuse allowing XML‑RPC API authentication bypass #3672641 Valid Authentication Medium 2026-06-03 – 8 Reflected XSS on /admin/stats.php #1097217 Valid Cross-site Scripting Medium 2021-03-16 – 9 Reflected XSS on /admin/stats.php #1187820 Valid Cross-site Scripting Medium 2021-06-03 – 12 Reflected XSS in stats‑video.php via improperly encoded URL parameters #3793243 Valid Cross-site Scripting Medium 2026-06-25 – 12 Use of a Broken or Risky Cryptographic Algorithm #1306942 Valid Cryptography Medium 2021-09-15 – 15 Reflected XSS on www/delivery/afr.php #775693 Valid Cross-site Scripting Medium 2020-01-21 – 16 Reflected XSS on /www/delivery/afr.php (bypass of report #775693) #986365 Valid Cross-site Scripting Medium 2021-01-19 – 16 Information Disclosure via “Add user” lookup in Account Management (User Access) #3401464 Valid Information Disclosure Medium 2025-11-19 – 16 Information Disclosure via Verbose Error Messages #3403450 Valid Information Disclosure Medium 2025-11-19 – 17 Reflected XSS in /admin/banner-zone.php (v6.0.0+) #3403727 Valid Cross-site Scripting Medium 2025-11-19 – 18 Reflected XSS on /admin/userlog-index.php #1083231 Valid Cross-site Scripting Medium 2021-01-26 – 20 CSRF in zone‑include.php allows unauthorized banner and campaign linking #3781691 Valid Cross-Site Request Forgery Medium 2026-06-25 – 20 Reflected XSS in account-preferences-plugin.php #3399191 Valid Cross-site Scripting Medium 2025-11-19 – 21 Stored XSS via Full Name field in userlog email entries #3669623 Valid Cross-site Scripting Medium 2026-06-03 – 21 Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval #3413890 Valid Denial of Service Medium 2025-11-19 – 22 Missing ownership validation allows cross‑manager tracker–campaign linking #3780709 Valid Insecure Direct Object Reference Medium 2026-06-25 – 22 Reflected XSS on /admin/stats.php Analysed #1083376 Valid Cross-site Scripting Medium 2021-01-26 – 24 Stored XSS in maintenance tools via unescaped entity names Analysed #3781311 Valid Cross-site Scripting Medium 2026-06-25 – 25 Reflected XSS via clientid parameter in zone‑include.php Analysed #3653316 Valid Cross-site Scripting Medium 2026-06-03 – 26 Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation) Analysed #3413764 Valid Injection and Smuggling Medium 2025-11-19 – 28 XML‑RPC login leak exposes valid session ID enabling unauthorized API access Analysed #3783738 Valid Access Control Medium 2026-06-25 – 28 Reflected XSS via unsanitised refresh parameter in zone invocation tag Analysed #3780806 Valid Cross-site Scripting Medium 2026-06-25 – 29 Stored-XSS in campaign name displayed in Banners modal Analysed #3411750 Valid Cross-site Scripting Medium 2025-11-19 – 32 Missing access control when linking trackers to campaigns Analysed #3650582 Valid Access Control Medium 2026-06-03 – 35 Reflected XSS in afr.php Analysed #3468169 Valid Cross-site Scripting Medium 2026-01-14 – 36 [revive-adserver] Reflected XSS in Banner Delivery Options via cap parameter Analysed #3473696 Valid Cross-site Scripting Medium 2026-01-14 – 37 Reflected XSS in banner-acl.php and channel-acl.php via executionorder Analysed #3470970 Valid Cross-site Scripting Medium 2026-01-14 – 39 Missing access control when linking banners or campaigns to zones Analysed #3650504 Valid Access Control Medium 2026-06-03 – 42 Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2 Analysed #3091390 Valid Cross-site Scripting Medium 2025-10-22 – 49 Username Validation Bypass Analysed #3434156 Valid Authentication Medium 2025-11-26 – 64