CVE-2025-52666

Published: Nov 20, 2025Modified: Jun 17, 2026

2.7

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Exploitability: 1.2 / Impact: 1.4

Source: support@hackerone.com (Secondary)

Description

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

Affected (2)

Products: Revive Adserver: Revive Adserver

Revive Adserver

1 product

Revive Adserver

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Revive Adserver Revive Adserver	Up to 5.5.2
Revive Adserver Revive Adserver	From 6.0.0 to 6.0.1

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (2)

https://hackerone.com/reports/3399218

Source: support@hackerone.com

ExploitIssue TrackingThird Party Advisory

https://hackerone.com/reports/3399218

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.