CVEvulnerability

CVE-2026-21640

2.7 LOW Published 2026-01-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0 ([email protected])
2.7 LOW — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-134

Description

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.

Affected configurations

• aquaplatform revive adserver (>= 6.0.0 <= 6.0.4)

Related

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References