Revive Adserver · Report #3826207
Stored XSS via unescaped tracker name in append-code check
Validstatus
mediumseverity
6upvotes
11 Nov 2026disclosed
Summary
Description
HackerOne community member flasks has reported a stored XSS vulnerability in the 'maintenance-appendcode-check.php' tool. A manager can store a malicious tracker name and cause the tracker to appear in the maintenance results. When an administrator opens the affected page, the name is displayed without proper escaping and the embedded JavaScript executes in the administrator's browser.
Resolution
Tracker names are now HTML-encoded when displayed by the append-code maintenance tool.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.