CVE-2025-55127: revive adserver — Exploit

Description

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.

Is your site exposed to CVE-2025-55127?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness Type (CWE)

CWE-156 CWE-156

Affected Products

Vendor	Product	Versions
aquaplatform	revive_adserver	6.0.0 — 6.0.3

References

Exploits

https://hackerone.com/reports/3413764

Frequently Asked Questions

What is CVE-2025-55127? +

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion. It has a CVSS v3.1 base score of 5.4 (MEDIUM).

How severe is CVE-2025-55127? +

CVE-2025-55127 has a CVSS v3.1 score of 5.4 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-55127? +

CVE-2025-55127 affects products from aquaplatform, specifically: revive_adserver. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-55127? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-6014 6.5

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. …

CVE-2025-6013 6.5

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true …

CVE-2025-55000 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-55001 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-55126 6.5

HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top …

CVE-2025-55128 6.5

HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with …

CVE-2025-55127