Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Revive Adserver: CSRF Attack via Admin Actions

CVE-2026-50743 · published 3 months ago
Summary

A security issue in Revive Adserver 6.0.7 allows an attacker to trick an administrator into making changes to ad campaigns or banners by sending them a malicious link or form. This could lead to unauthorized changes to ad campaigns or banners. To fix this issue, update to the latest version of Revive Adserver or apply the recommended patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
revive adserver <= 6.0.7
Original advisory text
A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests withou...
A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published20 Jul 2026
Updated26 Oct 2026
First seen20 Jul 2026
Sources
CVE-2026-50743 · NVD
CVE-2026-50743 · MITRE
Track software like this
Free during beta