Revive Adserver · Report #3399809

Stored XSS on inventory-retrieve.php

Validstatus

lowseverity

17upvotes

19 Nov 2025disclosed

How it was found

h1 team

i have found Cross-site Scripting (XSS) - Stored on inventory-retrieve.php and campaign-edit.php

steps here

1 go to Inventory --> Campaign ---> add payload in Name * 2 write any payload><img src=x onerror=alert(document.domain)> 4 open this http://localhost/ddf/revive-adserver-6.0.1/www/admin/inventory-retrieve.php?clientid=1 4 you see alert {F4932943}

{F4932944}

Cross-site Scripting (XSS) - Stored on inventory-retrieve.php and campaign-edit.php

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original