Read the docs
TI-2016-07742 Aliases CVE-2016-9471GHSA-j7g3-qm5c-2j6r

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection.

Priority LOW 18CWE-75Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fact that such characters are normally ignored when an HTML page is displayed in a browser. The issue could have therefore been exploited for user spoofing, although elevated privileges are required to create users within Revive Adserver.

Why it matters now

EPSS 0.01367 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Revive Adserver All versions before 3.2.5 and 4.0.0Revive Adserver All versions before 3.2.5 and 4.0.0—No fix listedCNA
  • Revive Adserver All versions before 3.2.5 and 4.0.0 Vendor— Affected Revive Adserver All versions before 3.2.5 and 4.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*up to 3.2.4VulnerableRevive Adserver
cpe:2.3:a:revive-adserver:revive_adserver:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableRevive Adserver
  • cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:* Versions up to 3.2.4 Vulnerable ·Revive Adserver
  • cpe:2.3:a:revive-adserver:revive_adserver:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Revive Adserver

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9471
  2. 2026-10-03 Alias added: GHSA-j7g3-qm5c-2j6r

References

Patch 2

Other 1

  • TI-2025-31114 Improper access control in Revive Adserver CVSS 3.0HIGH 8.8
  • TI-2020-06561 Open redirect in https://github.com/revive-adserver/revive-adserver CVSS 3.1MEDIUM 6.1
  • TI-2021-05734 Open redirect in https://github.com/revive-adserver/revive-adserver CVSS 3.1MEDIUM 6.1
  • TI-2025-32749 Missing authorization in Revive Adserver CVSS 3.1MEDIUM 6.5
  • TI-2025-34808 Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. CVSS 3.0MEDIUM 6.1
  • TI-2025-32747 Cross-site scripting in Revive Adserver CVSS 3.1MEDIUM 5.4
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences