CVE-2026-50740 is a reflected XSS vulnerability in Revive Adserver affecting versions up to and including 6.0.7. The vulnerability is due to insufficient sanitization of the refresh parameter in the zone-include.php script, which can be exploited by a low-privileged user to inject malicious scripts that are reflected back to users. The CVSS 3.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of the user interface. The impact is limited to confidentiality and integrity with no direct availability impact. The attacker requires user interaction and no privileges are needed to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected script or applying input validation and output encoding on the refresh parameter to mitigate the risk of reflected XSS attacks.