CVE-2026-21640

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings

Low · published January 20, 2026

CVSS v3.0
2.7
EPSS
0%
Percentile
15.6
In the wild
Unconfirmed
What it is

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.

The record
Technical detail
CVSS v3.0
2.7 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.6th percentile
Published
2026-01-20T20:48Z
EPSS history
Timeline
  • 20 JAN 20:48Z
    HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings
    cvelistv5