Vulnerability record · CVE-2013-5954 · published 25 April 2014

CVE-2013-5954: Revive-adserver revive adserver cross-site request forgery vulnerability

Revive Adserver · Revive Adserver

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.

6.8 CVSS 2.0 Medium EPSS 3.1% · top 12.8% CWE-352 · Cross-site request forgery

6.8CVSS 2.0 base score

3.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

14References, 6 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Openx Openx

Revive Adserver Revive Adserver

References

Link	Tags
http://packetstormsecurity.com/files/125735	Exploit
http://seclists.org/fulldisclosure/2014/Mar/270	Exploit
http://seclists.org/fulldisclosure/2014/May/68
http://www.revive-adserver.com/security/revive-sa-2014-001/
http://www.securityfocus.com/archive/1/532108/100/0/threaded
http://www.securityfocus.com/bid/66251	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/91889
http://packetstormsecurity.com/files/125735	Exploit
http://seclists.org/fulldisclosure/2014/Mar/270	Exploit
http://seclists.org/fulldisclosure/2014/May/68
http://www.revive-adserver.com/security/revive-sa-2014-001/
http://www.securityfocus.com/archive/1/532108/100/0/threaded
http://www.securityfocus.com/bid/66251	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/91889

Track CVE-2013-5954 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2013-4211OpenX Ad Server backdoor in flowplayer library allows PHP code executionOpenX Ad Server 2.8.10 ships a backdoored flowplayer-3.1.1.min.js library that permits remote arbitrary PHP code execution. The flaw is a code inject…EPSS 71%analysed14 Feb 2020 9.8CVE-2016-9124Revive-adserver revive adserver improper restriction of authentication attempts vulnerabilityRevive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable …EPSS 2.2%28 Mar 2017 9.8CVE-2016-9125Revive-adserver revive adserver vulnerabilityRevive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not inva…EPSS 2.7%28 Mar 2017 9.8CVE-2017-5830Revive-adserver revive adserver deserialization of untrusted data vulnerabilityRevive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.EPSS 3.3%3 Mar 2017 9.0CVE-2016-9470Revive-adserver revive adserver cross-site scripting vulnerabilityRevive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected F…EPSS 2.1%28 Mar 2017 8.8CVE-2026-50741Revive-adserver revive adserver code injection vulnerabilityBypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sen…EPSS 4.9%26 Jun 2026 8.8CVE-2025-48986Revive-adserver revive adserver improper access control vulnerabilityAuthorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and po…EPSS 0.62%20 Nov 2025 8.8CVE-2025-52664Revive-adserver revive adserver sql injection vulnerabilitySQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in use…EPSS 0.92%31 Oct 2025

Source: NIST National Vulnerability Database (record CVE-2013-5954), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.