Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0 #3395221 Valid SQL Injection High 2025-10-24 – 93 Username Validation Bypass #3434156 Valid Authentication Medium 2025-11-26 – 64 IDOR Vulnerability in Banner Deletion #3401612 Valid Insecure Direct Object Reference High 2025-11-19 – 56 Blind SQL injection via clientid parameter in zone‑include.php #3653196 Valid SQL Injection High 2026-06-03 – 49 Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2 #3091390 Valid Cross-site Scripting Medium 2025-10-22 – 49 Broken Access Control allows advertiser accounts to delete trackers they do not own #3445710 Valid Access Control High 2026-01-14 – 47 Login page password-guessing attack #96115 Valid Misconfiguration and Insecure Design – 2024-04-19 – 47 PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargeting #3781492 Valid Command and Code Injection High 2026-06-25 – 46 Missing access control when linking banners or campaigns to zones #3650504 Valid Access Control Medium 2026-06-03 – 42 Reflected XSS in banner-acl.php and channel-acl.php via executionorder #3470970 Valid Cross-site Scripting Medium 2026-01-14 – 39 [revive-adserver] Reflected XSS in Banner Delivery Options via cap parameter #3473696 Valid Cross-site Scripting Medium 2026-01-14 – 37 PHP code injection via delivery limitation logical #3656781 Valid Command and Code Injection High 2026-06-03 – 36 Reflected XSS in afr.php #3468169 Valid Cross-site Scripting Medium 2026-01-14 – 36 PHP code injection in delivery-limitation `logical` validation bypass #3780854 Valid Command and Code Injection High 2026-06-25 – 35 Missing access control when linking trackers to campaigns #3650582 Valid Access Control Medium 2026-06-03 – 35 Authorization bypass allows changing email address of other users #3398283 Valid Access Control High 2025-11-19 – 35 Stored-XSS in campaign name displayed in Banners modal #3411750 Valid Cross-site Scripting Medium 2025-11-19 – 32 Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php: #576504 Valid Authentication – 2019-05-21 – 31 Reflected XSS via unsanitised refresh parameter in zone invocation tag #3780806 Valid Cross-site Scripting Medium 2026-06-25 – 29 XML‑RPC login leak exposes valid session ID enabling unauthorized API access #3783738 Valid Access Control Medium 2026-06-25 – 28 Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation) #3413764 Valid Injection and Smuggling Medium 2025-11-19 – 28 Stored XSS in Conversion Statistics via Tracker Name #3400506 Valid Cross-site Scripting High 2025-11-19 – 28 Reflected XSS via clientid parameter in zone‑include.php #3653316 Valid Cross-site Scripting Medium 2026-06-03 – 26 Stored XSS in maintenance tools via unescaped entity names #3781311 Valid Cross-site Scripting Medium 2026-06-25 – 25 Improper sanitisation of input in the settings could cause DoS #3399218 Valid Input Validation and Logic Low 2025-11-19 – 24 Reflected XSS on /admin/stats.php #1083376 Valid Cross-site Scripting – 2021-01-26 – 24 Missing ownership validation allows cross‑manager tracker–campaign linking #3780709 Valid Insecure Direct Object Reference Medium 2026-06-25 – 22 Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval #3413890 Valid Denial of Service Medium 2025-11-19 – 22 bypass old password with array in /admin/account-user-email.php #792895 Valid Memory Corruption – 2020-03-12 – 22 Stored XSS via Full Name field in userlog email entries #3669623 Valid Cross-site Scripting Medium 2026-06-03 – 21 Stored-XSS in Banner Name field #3404968 Valid Cross-site Scripting Low 2025-11-19 – 21 Reflected XSS in account-preferences-plugin.php #3399191 Valid Cross-site Scripting Medium 2025-11-19 – 21 CSRF in zone‑include.php allows unauthorized banner and campaign linking #3781691 Valid Cross-Site Request Forgery Medium 2026-06-25 – 20 Reflected XSS on /admin/userlog-index.php #1083231 Valid Cross-site Scripting – 2021-01-26 – 20 INI Format string injection in Revive Adserver 6.0.4 settings #3445332 Valid Memory Corruption Low 2026-01-14 – 19 Reflected XSS in /admin/banner-zone.php (v6.0.0+) #3403727 Valid Cross-site Scripting Medium 2025-11-19 – 18 Information Disclosure via Verbose Error Messages #3403450 Valid Information Disclosure Medium 2025-11-19 – 17 Stored XSS on inventory-retrieve.php #3399809 Valid Cross-site Scripting Low 2025-11-19 – 17 Weak Forgot Password implementation #176116 Valid Authentication – 2017-08-02 – 17 Information Disclosure via “Add user” lookup in Account Management (User Access) #3401464 Valid Information Disclosure Medium 2025-11-19 – 16 Reflected XSS on /www/delivery/afr.php (bypass of report #775693) #986365 Valid Cross-site Scripting – 2021-01-19 – 16 Reflected XSS on www/delivery/afr.php #775693 Valid Cross-site Scripting – 2020-01-21 – 16 Use of a Broken or Risky Cryptographic Algorithm #1306942 Valid Cryptography – 2021-09-15 – 15 Reflected XSS in stats‑video.php via improperly encoded URL parameters #3793243 Valid Cross-site Scripting Medium 2026-06-25 – 12 Reflected XSS on /admin/stats.php #1187820 Valid Cross-site Scripting – 2021-06-03 – 12 PHP code injection via unexpected delivery limitation parameter #3744200 Valid Command and Code Injection High 2026-06-03 – 11 Deserialization of Untrusted Data in www/delivery/dxmlrpc.php #542670 Valid Deserialization and Object Injection – 2019-04-23 – 11 Stored XSS on Admin Access Page - Email field #173501 Valid Cross-site Scripting – 2017-08-02 – 10 Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser #3680090 Valid Cross-site Scripting None 2026-06-03 – 9 Reflected XSS on /admin/stats.php #1097217 Valid Cross-site Scripting – 2021-03-16 – 9