How severe is CVE-2025-55127?

CVE-2025-55127 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-55127 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-55127?

CVE-2025-55127 affects Aquaplatform Revive Adserver. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-55127?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-55127 have an EU (EUVD) identifier?

Yes. CVE-2025-55127 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198344.

When was CVE-2025-55127 published?

CVE-2025-55127 was published on 2025-11-20 and last updated on 2026-06-17.

CVE-2025-55127

CVE-2025-55127 is a medium-severity vulnerability in Aquaplatform Revive Adserver with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-156.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-198344
Weakness: CWE-156
Affected product: Aquaplatform Revive Adserver
Published: 2025-11-20
Last modified: 2026-06-17

Description

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.

Frequently asked questions

What is CVE-2025-55127?: HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.
How severe is CVE-2025-55127?: CVE-2025-55127 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-55127 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-55127?: CVE-2025-55127 affects Aquaplatform Revive Adserver. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-55127?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-55127 have an EU (EUVD) identifier?: Yes. CVE-2025-55127 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198344.
When was CVE-2025-55127 published?: CVE-2025-55127 was published on 2025-11-20 and last updated on 2026-06-17.

References

https://hackerone.com/reports/3413764

Affected products (1)

cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*

More vulnerabilities in Aquaplatform Revive Adserver

CVE-2026-21641 — Medium (CVSS 6.5): HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the…
CVE-2025-55128 — Medium (CVSS 6.5): HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in…
CVE-2025-55126 — Medium (CVSS 6.5): HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box…
CVE-2026-21664 — Medium (CVSS 6.1): HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php…
CVE-2026-21663 — Medium (CVSS 6.1): HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script…
CVE-2026-21642 — Medium (CVSS 6.1): HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and…

All CVEs affecting Aquaplatform Revive Adserver →

Other CWE-156 vulnerabilities

CVE-2025-55001 — Medium (CVSS 6.5): OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets,…
CVE-2025-55000 — Medium (CVSS 6.5): OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets,…
CVE-2025-6013 — Medium (CVSS 6.5): Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias…
CVE-2025-6014 — Medium (CVSS 6.5): Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse…

Browse all CWE-156 vulnerabilities →