Stored Cross-Site Scripting in Revive Adserver Affects Multiple Versions

CVE-2026-108561

What is CVE-2026-108561?

A stored cross-site scripting vulnerability exists in the report date-selection controls of Revive Adserver versions up to 6.0.8. This flaw enables an unauthenticated attacker to execute malicious JavaScript code in the browser of a user who follows a specially crafted report URL. By leveraging an attacker-controlled 'period_preset' value, the attacker can save this value in the victim's session without proper encoding, leading to the execution of the JavaScript payload during initial and subsequent report views leveraging stored defaults. The issue has been resolved in version 6.0.9, which implements JSON encoding suitable for the JavaScript context to safeguard date-selection values.

References