CVE-2025-52666

LowCVSS 2.7/10Last modified Sep 26, 2026

Description

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.

Metrics

CVSS 3.0 2.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-134

Affected software

No affected versions have been published.

Timeline

Published: Nov 20, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526675.4Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possib CVE-2025-526685.4Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential i CVE-2025-526694.3Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to hav CVE-2025-52675.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerab CVE-2025-526706.5Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by ot CVE-2025-526714.3Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a CVE-2025-52688.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence o CVE-2025-526872.4Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious CVE-2025-526889.8Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentiall CVE-2025-526899.8Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privile CVE-2025-52698.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that w CVE-2025-526908.1Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss