Description
HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
INFO
Published Date :
2026-01-20T20:48:47.976Z
Last Modified :
2026-01-21T20:45:35.234Z
Source :
hackerone
AFFECTED PRODUCTS
The following products are affected by CVE-2026-21664 vulnerability.
| Vendors | Products |
|---|---|
| Aquaplatform |
|
| Revive |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-21664.
| URL | Resource |
|---|---|
| https://hackerone.com/reports/3468169 |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact