Reflected Cross-Site Scripting in Revive Adserver by Revive Adserver
CVE-2026-108565

4.7MEDIUM

Key Information:

Vendor

Revive

Status
Adserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-108565?

A reflected cross-site scripting vulnerability exists in the popup invocation options of Revive Adserver prior to version 6.0.9. This allows unauthenticated attackers to execute malicious JavaScript code in the browsers of authenticated users by tricking them into clicking a specially crafted link. The vulnerability arises because the top, left, timeout, and delay parameters are improperly output into HTML attributes without adequate encoding. Exploiting this vulnerability requires the presence of an existing popup zone, which can be set up using the administrator API, even though it is not immediately accessible via the standard zone-creation interface. The issue was resolved in version 6.0.9 by applying proper HTML encoding to the affected popup option values, mitigating the risk of XSS.

Affected Version(s)

Adserver 0 <= 6.0.8

References

https://hackerone.com/reports/3971985

CVSS V3.0

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

miauzxw
.