CVE-2025-52666CWE-134

CVE-2025-52666

Low · published November 21, 2025

CVSS v3.0
2.7
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

The record
Technical detail
CVSS v3.0
2.7 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2025-11-21T01:16Z
Affected products (2)
ProductVersionsFixed in
revive-adserver/revive_adserver≤ 5.5.2—
revive-adserver/revive_adserver≥ 6.0.0, ≤ 6.0.1—
References (2)
https://hackerone.com/reports/3399218 · [email protected]https://hackerone.com/reports/3399218 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 NOV 19:10Z
    Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable…
    cvelistv5