CVE-2026-34915

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 6.0.7

Description Insufficient sanitization of user input in the 'zone-include.php' script allows a low-privileged user to perform blind SQL injection attacks. This occurs through the clientid parameter. Blind SQL injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response.

Recommendations Update to version 6.0.7 or later. As a temporary mitigation, restrict access to the 'zone-include.php' script.