VulnerabilityAnalyzed
CVE-2026-50745
A missing sanitisation vulnerability exists with user input in the stats-video.php script.
MEDIUM 6.1EPSS 0.38%
Does this matter?
Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.
Description
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.38% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- revive-adserver/revive adserver
- Source
- support@hackerone.com
References
- https://hackerone.com/reports/3793243Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.