CVE-2026-44959

A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out.

• CWE-94

• https://hackerone.com/reports/3744200

Published

Jun 23, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44949A Rancher FleetWorkspace admission path allowed side effects…7
• CVE-2026-4495A security flaw has been discovered in atjiu pybbs 6.0.0. Th…3.5
• CVE-2026-44955Pronetiqs IntraVUE versions 3.2.1a14 and prior have an expos…6.9
• CVE-2026-44956Low‑privileged users could use their Full Name as a vector f…0
• CVE-2026-44957A missing access control check when invoking various modify …4.3
• CVE-2026-44958An access control bypass allows an advertiser‑level user to …5.4
• CVE-2026-4496A vulnerability was found in sigmade Git-MCP-Server up to 78…5.3
• CVE-2026-44960A stored XSS can be exploited by leveraging the usernames as…0
• CVE-2026-44961The XML‑RPC API addUser method has a validation bypass intro…0
• CVE-2026-44962Plesk contains an XPath injection vulnerability in the APS A…9.9
• CVE-2026-44963A vulnerability allowing remote code execution (RCE) on the …9.4
• CVE-2026-44964In versions of the Datadog Android application prior to v545…6.5