CVE-2026-50742 Cross-site scripting in Adserver
Stored XSS in Revive Adserver maintenance tools allows attackers to execute scripts in administrator browsers via unescaped entity names.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50742?
CVE-2026-50742 is a medium-severity cross-site scripting vulnerability in Revive-Adserver Revive Adserver, published on 26 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
Weakness: CWE-79
Which versions are affected by CVE-2026-50742?
It affects 1 product.
Products include Revive-Adserver Revive Adserver.
How do I fix CVE-2026-50742?
No fix has been published for CVE-2026-50742 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-50742 being exploited?
There is no known exploitation of CVE-2026-50742 in the wild and no public exploit code.
Other vulnerabilities in Revive-Adserver Revive Adserver
- CVE-2016-9124 Security feature bypass in Revive Adserver All versions before 3.2.3
- CVE-2016-9125 Auth bypass in Revive Adserver All versions before 3.2.3
- CVE-2017-5830 Deserialization in n/a
- CVE-2016-9470 Other in Revive Adserver All versions before 3.2.5 and 4.0.0
- CVE-2026-50741 Code injection in Adserver
Sources
Also known as GHSA-q7h4-cw8q-5rmq.