Reflected XSS in Revive Adserver stats-video.php via Smarty url() (CVE-2026-50745)

Vulnerability Overview Vulnerability Type: Reflected Cross-Site Scripting (XSS) Vulnerability Description: In the script, user input was not correctly encoded or sanitized, allowing user-provided input to be reflected without escaping. Reporter: Mahmoud Khaled (Kanon4) Report Time: June 10, 2026, 4:40 AM UTC Disclosure Time: June 25, 2026, 1:13 PM UTC Severity: Medium (4.7) CVE ID: CVE-2026-50745 Affected Scope Affected File: Affected Function: The Smarty custom helper function did not correctly encode or sanitize user input, leading to a reflected XSS vulnerability. Remediation Status: Resolved Fix Time: June 10, 2026, 7:34 AM UTC Remediation Measures: The Revive Adserver team has patched the vulnerability, ensuring that user input is properly encoded and sanitized. Proof of Concept (POC) No specific POC code or exploit code was provided in the report. Additional Information Report ID: #175248 Participants: Kanon4, Revive Adserver Reward: Hidden Retest: Hidden Account Details: None Timeline June 10, 2026, 4:40 AM UTC: Kanon4 submitted the report to Revive Adserver. June 10, 2026, 7:34 AM UTC: mbecatti (Revive Adserver staff) changed the status to "Needs more info". June 10, 2026, 7:34 AM UTC: Kanon4 changed the status to "New". June 11, 2026, 7:34 AM UTC: mbecatti (Revive Adserver staff) changed the status to "Triage". 7 days ago: mbecatti (Revive Adserver staff) closed the report and changed the status to "Resolved". 7 days ago: Kanon4 posted a comment. 5 days ago: mbecatti (Revive Adserver staff) posted a comment. 5 days ago: mbecatti (Revive Adserver staff) updated the CVE reference to CVE-2026-50745. 3 days ago: mbecatti (Revive Adserver staff) changed the report title. 5 days ago: Kanon4 requested disclosure of this report. 1 day ago: mbecatti (Revive Adserver staff) agreed to the disclosure. 1 day ago: This report has been disclosed.

Goal Reached Thanks to every supporter — we hit 100%!

Reflected XSS in Revive Adserver stats-video.php via Smarty url() (CVE-2026-50745)