CVE-2025-52670

MediumCVSS 6.5/10Last modified Sep 26, 2026

Description

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 20, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526714.3Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to a CVE-2025-52688.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence o CVE-2025-526872.4Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious CVE-2025-526889.8Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentiall CVE-2025-526899.8Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privile CVE-2025-52698.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that w CVE-2025-526908.1Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss CVE-2025-5269110.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail s CVE-2025-526928.8Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access cer CVE-2025-526949.8Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands CVE-2025-52707.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and CVE-2025-527076.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fanc