BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-12-02

Assigner: HackerOne

Description

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-52666

EUVD

EUVD-2025-198351

Affected Vendors & Products

Vendor	Product	Version / Range
revive-adserver	revive_adserver	to 5.5.2 (inc)
revive-adserver	revive_adserver	From 6.0.0 (inc) to 6.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This vulnerability is caused by improper neutralisation of format characters in the settings of Revive Adserver versions 5.5.2, 6.0.1, and earlier. It leads to a fatal PHP error that disables the administrator user console.

Impact Analysis

The vulnerability can cause the administrator user console to be disabled due to a fatal PHP error, potentially limiting administrative access and management of the Revive Adserver.

Hi! I’m here to help you understand CVE-2025-52666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70