CVE-2026-21664: Aquaplatform Revive Adserver

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

Affected products

• Aquaplatform Revive Adserver: from 6.0.0, up to and including 6.0.4

Published 2026-01-20. Last modified 2026-06-17.