Vulnerability · Published Jun 23, 2026 · Assigned by hackerone
CVE-2026-44960
None 0.0
In plain English
A cross-site scripting in Adserver from Revive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.0)0.0None
Exploit odds (30 days)0.4%top 66.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N