CVE-2026-21642: Aquaplatform Revive Adserver

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

Affected products

• Aquaplatform Revive Adserver: up to and including 6.0.4

Published 2026-01-20. Last modified 2026-06-17.