Revive Adserver · Report #3942028

Reflected XSS via invocation banner ID field in admin-generate.php

Validstatus

mediumseverity

9upvotes

11 Nov 2026disclosed

Summary

Description

HackerOne community member Umesh Paytode has reported reflected XSS through the banner identifier in the invocation-tag generation interface. When Direct Selection is enabled, attacker-supplied input could be included in HTML form fields without proper encoding. Successful exploitation requires an attacker to persuade an authenticated user to visit a crafted URL. Direct Selection is disabled by default.

Resolution

Banner identifier values are now HTML-encoded when included in invocation-option form fields.

Security advisory

https://www.revive-adserver.com/security/revive-sa-2026-004

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original