Description

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

INFO

Published Date :

2026-01-20T20:48:47.974Z

Last Modified :

2026-01-21T20:42:21.072Z

Source :

hackerone
AFFECTED PRODUCTS

The following products are affected by CVE-2026-21663 vulnerability.

Vendors Products
Aquaplatform
  • Revive Adserver
Revive
  • Adserver
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-21663.

URL Resource
https://hackerone.com/reports/3473696 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact