Aquaplatform's vulnerability footprint centers on its Revive AdServer product, a web-based digital advertising platform deployed across publisher and network environments. The recurring weakness classes reflect the application's web-facing role and input-handling demands: cross-site scripting, authorization flaws, Unicode-encoding issues, whitespace normalization, and resource-consumption conditions are the durable signature of this vendor's disclosures. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Aquaplatform over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-21664MEDIUM HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a sp | Jan 20, 2026 | 6.1 | 24 | NO | NO |
CVE-2026-21641MEDIUM HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to | Jan 20, 2026 | 6.5 | 23 | NO | NO |
CVE-2025-55128MEDIUM HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with access to the admin | Nov 20, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-55126MEDIUM HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages, with campaign names | Nov 20, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-55129MEDIUM HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-526 | Dec 2, 2025 | 5.4 | 21 | NO | NO |
CVE-2026-21663MEDIUM HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that | Jan 20, 2026 | 6.1 | 19 | NO | NO |
CVE-2026-21642MEDIUM HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can c | Jan 20, 2026 | 6.1 | 19 | NO | NO |
CVE-2025-55127MEDIUM HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailin | Nov 20, 2025 | 5.4 | 19 | NO | NO |
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a sett | Jan 20, 2026 | 2.7 | 15 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Aquaplatform.
Media articles that mention a CVE ID that affects a product developed by Aquaplatform — matched by CVE ID, not by vendor name.