CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.

• CWE-79
• CWE-79

• https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ecIssue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/97073Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory
• https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ecIssue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/97073Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9120Race condition in the ion_ioctl function in drivers/staging/…7.8
• CVE-2016-9121go-jose before 1.0.4 suffers from an invalid curve attack fo…
• CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploi…
• CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflo…
• CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restricti…
• CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, …
• CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9128Revive Adserver before 3.2.3 suffers from reflected XSS. The…
• CVE-2016-9129Revive Adserver before 3.2.3 suffers from Information Exposu…
• CVE-2016-9130Revive Adserver before 3.2.3 suffers from Persistent XSS. A …
• CVE-2016-9131named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-…7.5
• CVE-2016-9132In Botan 1.8.0 through 1.11.33, when decoding BER data an in…