CVE-2026-34914

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 6.0.7

Description Insufficient sanitization of user input in the 'zone-include.php' script allows a low-privileged user to perform blind SQL injection attacks. This is achieved by exploiting the clientid parameter. Blind SQL injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response.

Recommendations Update to version 6.0.7 or later. As a temporary workaround, restrict access to the 'zone-include.php' script or avoid using the clientid parameter until the update is applied.