low2.7
CVE-2026-21640
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings.
Impact
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aquaplatform | Revive Adserver | from 6.0.0 through 6.0.4 |