Reflected Cross-Site Scripting Vulnerability in Revive Adserver by Revive Network

CVE-2026-108560

What is CVE-2026-108560?

A reflected cross-site scripting vulnerability exists in the updates-history.php file of Revive Adserver versions 6.0.8 and earlier. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser by enticing them to visit a specially crafted URL. Due to insufficient encoding of user-controlled values in XML command attributes, malicious content can be injected into the application’s responses. Furthermore, a preliminary session check does not apply to GET xajax requests, thus leaving an entry point for unauthenticated attacks. Authenticated administrators may also inadvertently access unsafe output. The vulnerability has been addressed in Revive Adserver version 6.0.9, which enhances session checks for both GET and POST requests and ensures proper encoding of XML command attributes.

References