HexBrain
Sign in

Browse / Revive Adserver

Revive Adserver

75disclosed reports

See its reports on the map

What gets reported to Revive Adserver

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0SQL Injection · high
    93 votes
  2. Username Validation BypassImproper Authentication - Generic · medium
    64 votes
  3. IDOR Vulnerability in Banner Deletion Insecure Direct Object Reference (IDOR) · high
    56 votes
  4. Blind SQL injection via clientid parameter in zone‑include.phpSQL Injection · high
    49 votes
  5. Reflected Cross-Site Scripting (XSS) in Revive Adserver 5.5.2Cross-site Scripting (XSS) - Reflected · medium
    49 votes
  6. Broken Access Control allows advertiser accounts to delete trackers they do not ownImproper Access Control - Generic · high
    47 votes
  7. Login page password-guessing attackViolation of Secure Design Principles
    47 votes
  8. PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingCode Injection · high
    46 votes
  9. Missing access control when linking banners or campaigns to zones Improper Access Control - Generic · medium
    42 votes
  10. Reflected XSS in banner-acl.php and channel-acl.php via executionorderCross-site Scripting (XSS) - Reflected · medium
    39 votes
  11. [revive-adserver] Reflected XSS in Banner Delivery Options via cap parameterCross-site Scripting (XSS) - Reflected · medium
    37 votes
  12. PHP code injection via delivery limitation logical Code Injection · high
    36 votes
  13. Reflected XSS in afr.phpCross-site Scripting (XSS) - Reflected · medium
    36 votes
  14. PHP code injection in delivery-limitation `logical` validation bypassCode Injection · high
    35 votes
  15. Missing access control when linking trackers to campaignsImproper Access Control - Generic · medium
    35 votes
  16. Authorization bypass allows changing email address of other usersImproper Access Control - Generic · high
    35 votes
  17. Stored-XSS in campaign name displayed in Banners modalCross-site Scripting (XSS) - Stored · medium
    32 votes
  18. Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:Improper Authentication - Generic · high
    31 votes
  19. Reflected XSS via unsanitised refresh parameter in zone invocation tagCross-site Scripting (XSS) - Reflected · medium
    29 votes
  20. XML‑RPC login leak exposes valid session ID enabling unauthorized API accessImproper Access Control - Generic · medium
    28 votes
  21. Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation)Improper Neutralization of Whitespace · medium
    28 votes
  22. Stored XSS in Conversion Statistics via Tracker NameCross-site Scripting (XSS) - Stored · high
    28 votes
  23. Reflected XSS via clientid parameter in zone‑include.phpCross-site Scripting (XSS) - Reflected · medium
    26 votes
  24. Stored XSS in maintenance tools via unescaped entity namesCross-site Scripting (XSS) - Stored · medium
    25 votes
  25. Improper sanitisation of input in the settings could cause DoSBusiness Logic Errors · low
    24 votes
  26. Reflected XSS on /admin/stats.phpCross-site Scripting (XSS) - Reflected · medium
    24 votes
  27. Missing ownership validation allows cross‑manager tracker–campaign linkingInsecure Direct Object Reference (IDOR) · medium
    22 votes
  28. Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrievalAllocation of Resources Without Limits or Throttling · medium
    22 votes
  29. bypass old password with array in /admin/account-user-email.phpArray Index Underflow · low
    22 votes
  30. Stored XSS via Full Name field in userlog email entriesCross-site Scripting (XSS) - Stored · medium
    21 votes
  31. Stored-XSS in Banner Name field Cross-site Scripting (XSS) - Stored · low
    21 votes
  32. Reflected XSS in account-preferences-plugin.phpCross-site Scripting (XSS) - Reflected · medium
    21 votes
  33. CSRF in zone‑include.php allows unauthorized banner and campaign linkingCross-Site Request Forgery (CSRF) · medium
    20 votes
  34. Reflected XSS on /admin/userlog-index.phpCross-site Scripting (XSS) - Reflected · medium
    20 votes
  35. INI Format string injection in Revive Adserver 6.0.4 settingsUse of Externally-Controlled Format String · low
    19 votes
  36. Reflected XSS in /admin/banner-zone.php (v6.0.0+)Cross-site Scripting (XSS) - Reflected · medium
    18 votes
  37. Information Disclosure via Verbose Error MessagesInformation Exposure Through an Error Message · medium
    17 votes
  38. Stored XSS on inventory-retrieve.phpCross-site Scripting (XSS) - Stored · low
    17 votes
  39. Weak Forgot Password implementationImproper Authentication - Generic · low
    17 votes
  40. Information Disclosure via “Add user” lookup in Account Management (User Access)Exposure of Sensitive Information Due to Incompatible Policies · medium
    16 votes
  41. Reflected XSS on /www/delivery/afr.php (bypass of report #775693)Cross-site Scripting (XSS) - Reflected · medium
    16 votes
  42. Reflected XSS on www/delivery/afr.phpCross-site Scripting (XSS) - Reflected · medium
    16 votes
  43. Use of a Broken or Risky Cryptographic AlgorithmUse of a Broken or Risky Cryptographic Algorithm · medium
    15 votes
  44. Reflected XSS in stats‑video.php via improperly encoded URL parametersCross-site Scripting (XSS) - Reflected · medium
    12 votes
  45. Reflected XSS on /admin/stats.phpCross-site Scripting (XSS) - Reflected · medium
    12 votes
  46. PHP code injection via unexpected delivery limitation parameterCode Injection · high
    11 votes
  47. Deserialization of Untrusted Data in www/delivery/dxmlrpc.phpDeserialization of Untrusted Data · critical
    11 votes
  48. Stored XSS on Admin Access Page - Email fieldCross-site Scripting (XSS) - Generic · high
    10 votes
  49. Reflected XSS via invocation banner ID field in admin-generate.phpCross-site Scripting (XSS) - Reflected · medium
    9 votes
  50. Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser Cross-site Scripting (XSS) - Stored
    9 votes
  51. Reflected XSS on /admin/stats.phpCross-site Scripting (XSS) - Reflected · medium
    9 votes
  52. CSRF in tracker invocation pageCross-Site Request Forgery (CSRF) · medium
    8 votes
  53. Cross-agency disclosure in website listingInsecure Direct Object Reference (IDOR) · medium
    8 votes
  54. Reflected XSS via wrong permission check in conversion statisticsCross-site Scripting (XSS) - Reflected · medium
    8 votes
  55. Session ID reuse allowing XML‑RPC API authentication bypassImproper Authentication - Generic · medium
    8 votes
  56. Formula injection in conversion tracking report exportCode Injection · medium
    7 votes
  57. Missing access control when modifying parent entities via XML‑RPCImproper Access Control - Generic · medium
    7 votes
  58. Reflected XSS on /admin/campaign-zone-zones.phpCross-site Scripting (XSS) - Reflected · medium
    7 votes
  59. Open redirection bypass in /www/admin/campaign-modify.phpOpen Redirect · low
    7 votes
  60. Reflected XSS on Zones > Invocation CodeCross-site Scripting (XSS) - Generic · low
    7 votes
  61. Reflected XSS in popup invocation optionsCross-site Scripting (XSS) - Reflected · medium
    6 votes
  62. Missing campaign ownership check in zone bulk linkingInsecure Direct Object Reference (IDOR) · medium
    6 votes
  63. Cross-agency delivery rule set creationInsecure Direct Object Reference (IDOR) · medium
    6 votes
  64. Stored XSS via unescaped tracker name in append-code checkCross-site Scripting (XSS) - Stored · medium
    6 votes
  65. Reflected XSS in Step 2 of the InstallationCross-site Scripting (XSS) - Generic
    6 votes
  66. Banner status override by advertiser‑level usersImproper Access Control - Generic · medium
    5 votes
  67. Cross Site Scripting and Open Redirect in affiliate-preview.php file Open Redirect · low
    4 votes
  68. Deserialization of Untrusted Data in www/delivery/adxmlrpc.phpDeserialization of Untrusted Data · critical
    4 votes
  69. Open redirect in switch account functionalityOpen Redirect · low
    3 votes
  70. Stored XSS in report date selectionCross-site Scripting (XSS) - Stored · medium
    2 votes
  71. Unauthenticated reflected XSS in update historyCross-site Scripting (XSS) - Reflected · medium
    2 votes
  72. Open redirect in ck.php and lg.phpOpen Redirect · medium
    2 votes
  73. Reflected XSS via invocation iFrame size fieldsCross-site Scripting (XSS) - Reflected · medium
    1 votes
  74. Blind SQL injection due to request precedence issue in global input registrationSQL Injection · high
    1 votes
  75. Access control bypass due to request precedence issue in global input registrationInsecure Direct Object Reference (IDOR) · high
    1 votes