CVE-2021-22948: Revive-Adserver Revive Adserver

High severity, CVSS 7.1. EPSS: 2.7% chance of exploitation in the next 30 days.

Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account.

Affected products

• Revive-Adserver Revive Adserver: before 5.3.0 (fixed in 5.3.0); version 5.3.0 only

Published 2021-09-23. Last modified 2026-06-17.