CVE-2026-34914
Deferred Deferred - Pending Action
Blind SQL Injection in Revive Adserver

Publication date: 2026-06-23

Last updated on: 2026-06-23

Assigner: HackerOne

Description
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-23
Last Modified
2026-06-23
Generated
2026-06-23
AI Q&A
2026-06-23
EPSS Evaluated
N/A
NVD
CVE-2026-34914
EUVD
EUVD-2026-38506
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
revive_adserver revive_adserver to 6.0.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, ensure that you upgrade Revive Adserver to version 6.0.6 or later where input sanitisation has been improved to properly validate all parameters processed by the zone-include.php script.

Additionally, restrict low-privileged user access to the vulnerable parameters, such as the clientid parameter, to reduce the risk of blind SQL injection attacks.

Impact Analysis

Exploitation of this vulnerability allows a low-privileged user to perform blind SQL injection attacks. This can lead to unauthorized access to or manipulation of the database.

  • Confidentiality impact: Limited (some data may be exposed).
  • Integrity impact: High (data can be altered).
  • Availability impact: High (service disruption or denial of service may occur).
Executive Summary

This vulnerability is a missing sanitisation of user input in the zone-include.php script of Revive Adserver version 6.0.6 and earlier. Specifically, a low-privileged user can exploit the clientid parameter to perform blind SQL injection attacks. The issue arises because the input is not properly validated before being processed by the script.

The vulnerability has been addressed by improving input sanitisation to ensure that all parameters processed by the script are properly validated.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34914. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart