Vulnerability Details CVE-2026-21640
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.1%
CVSS Severity
CVSS v3 Score 2.7
References
Products affected by CVE-2026-21640
-
cpe:2.3:a:aquaplatform:revive_adserver:*