CVE-2025-52669

MediumCVSS 4.3/10Last modified Sep 26, 2026

Description

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Revive	Revive Adserver	>= 6, <= 6.0.1; >= 5, <= 5.5.2

References

https://hackerone.com/reports/3401464Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/3401464Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Nov 20, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-52675.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerab CVE-2025-526706.5Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by ot CVE-2025-526714.3Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a CVE-2025-52688.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence o CVE-2025-526872.4Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious CVE-2025-526889.8Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentiall CVE-2025-526899.8Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privile CVE-2025-52698.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that w CVE-2025-526908.1Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss CVE-2025-5269110.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail s CVE-2025-526928.8Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access cer CVE-2025-526949.8Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands