BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-01-30

Assigner: HackerOne

Description

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-01-30

Generated

2026-07-06

AI Q&A

2026-01-20

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21642

EUVD

EUVD-2026-3324

Affected Vendors & Products

Vendor	Product	Version / Range
aquaplatform	revive_adserver	to 6.0.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Impact Analysis

If exploited, this vulnerability can allow attackers to execute malicious scripts in the browser of an administrator. This can lead to unauthorized actions performed with the administrator's privileges, potential theft of sensitive information, session hijacking, or other malicious activities.

Executive Summary

This vulnerability is a reflected Cross-Site Scripting (XSS) issue in the 'banner-acl.php' and 'channel-acl.php' scripts of Revive Adserver. An attacker can create a specially crafted URL containing malicious HTML code in a parameter. When a logged-in administrator clicks this URL, the malicious code is executed in their browser.

Hi! I’m here to help you understand CVE-2026-21642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70