CVE-2026-34916

HighCVSS 8.8/10Last modified Jun 23, 2026

Description

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 23, 2026
Last modified: Jun 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-349174.3Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict CVE-2026-34926.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is CVE-2026-349266.7A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table CVE-2026-349277.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349287.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349297.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349307.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349319.6hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to tok CVE-2026-349329.3hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF CVE-2026-349335.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any u CVE-2026-349349.8PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strin CVE-2026-349359.8PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.sp