Reflected Cross-Site Scripting Vulnerability in Revive Adserver by Revive Adserver
CVE-2026-108564

4.7MEDIUM

Key Information:

Vendor

Revive

Status
Adserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-108564?

A reflected cross-site scripting vulnerability exists in the invocation-tag generation interface of Revive Adserver versions 6.0.8 and earlier. This issue allows unauthenticated attackers to execute JavaScript in the browsers of authenticated users by tricking them into visiting a specially crafted URL. When the Direct Selection feature is enabled, an attacker may exploit this vulnerability by inserting a malicious banner identifier into HTML form fields without proper encoding, compromising user security. The vulnerability has been addressed in Revive Adserver version 6.0.9, which includes HTML encoding for banner identifier values in the associated form fields.

Affected Version(s)

Adserver 0 <= 6.0.8

References

https://hackerone.com/reports/3942028

CVSS V3.0

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Umesh Paytode
.