VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jun 26, 2026· Updated Jul 8, 2026

CVE-2026-50740

CVE-2026-50740

Description

A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.

Affected products

2
  • Revive Adserver/Adserver2 versions
    cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*range: <6.0.8
    • (no CPE)range: <=6.0.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.