CVE-2026-34915

MediumCVSS 6.1/10Last modified Oct 26, 2026

Description

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ReviveAdserver<= 6.0.6

References

Timeline

Published
Jun 23, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-349168.8A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user tCVE-2026-349174.3Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrictCVE-2026-34926.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is CVE-2026-349266.7A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key tableCVE-2026-349277.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349287.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349297.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349307.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349319.6hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to tokCVE-2026-349329.3hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRFCVE-2026-349335.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any uCVE-2026-349349.8PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strin