CVE-2026-21663

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver

Medium · published January 20, 2026

CVSS v3.0
6.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

The record
Technical detail
CVSS v3.0
6.1 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.4th percentile
Published
2026-01-20T20:48Z
EPSS history
Timeline
  • 20 JAN 20:48Z
    HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver
    cvelistv5