Revive Adserver · Report #3780806
Reflected XSS via unsanitised refresh parameter in zone invocation tag
Validstatus
mediumseverity
29upvotes
25 Jun 2026disclosed
Summary
HackerOne community member Mahmoud Khaled (Kanon4) has reported a missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.