CVE-2026-107662

Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.

• CWE-89

• https://hackerone.com/reports/3896779

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107656An authentication bypass using an alternate path or channel …9.8
• CVE-2026-107657The HivePress – Business Directory, Listings & Classified Ad…7.2
• CVE-2026-107658The BuddyForms plugin for WordPress is vulnerable to Stored …5.4
• CVE-2026-107659The Modula Image Gallery – Photo Grid & Video Gallery plugin…7.5
• CVE-2026-10766A vulnerability has been found in mlrun up to 1.12.0-rc3. Th…3.6
• CVE-2026-107660FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an imprope…4.8
• CVE-2026-107671A vulnerability allowing an attacker with valid Administrato…8.5
• CVE-2026-107672A maliciously crafted .stack.json file can trigger a trusted…8.8
• CVE-2026-107674IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of se…4.4
• CVE-2026-107675FFmpeg through 9.0.2 contains a missing host key verificatio…5.9
• CVE-2026-107676FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-107677FFmpeg through 9.0.2 contains a denial of service vulnerabil…4.7