🎯 New Report #3780806: Reflected XSS via unsanitised refresh parameter in zone invocation tag
🔺Severity: Medium
👽 Reporter: kanon4
⭐️ Reputation: 1160
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-06-25 13:41:12
📝 Summary: A missing sanitization of user input in the zone-include.php script of Revive Adserver 6.0.7 and earlier was reported. This vulnerability allowed a low-privileged user to perform reflected XSS attacks by exploiting the refresh parameter of the iFrame invocation tag.
📂 Report JSON File: 3780806
@hackeronereports