CVE-2026-50742
Description
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
Summary dbcve.org
Stored XSS vulnerability in Revive Adserver 6.0.7 maintenance tools where entity names are displayed without HTML escaping when inconsistencies are detected, allowing injection of malicious scripts that execute when administrators use maintenance-acl-check.php or maintenance-banners-check.php.
Mitigation
Implement proper HTML entity encoding for all user-supplied entity names before display output in the affected maintenance tools to prevent script injection.