CVE-2026-107662 · Package
NO FIX YET · SEE WHAT TO DO
Revive Adserver 6.0.8 and earlier lets an authenticated agency-restricted manager inject SQL through the banner-zone and campaign-zone admin pages. An attacker can extract password hashes and active session identifiers, then reuse an unexpired administrator session to change configuration and disrupt ad delivery.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Revive Adserver 6.0.8 or earlier that have manager accounts restricted to one agency are exposed, since those accounts can reach the vulnerable banner-zone and campaign-zone pages. Installations on 6.0.9 or later, or without agency-restricted manager users, are not affected by this flaw.
Not affected if no-agency-restricted-managers, version-6.0.9-or-later
Who cares ad-servers, php, revive-adserver, self-hosted
package.json/installed release files; versions 6.0.8 and earlier are affected6.0.9, which includes commits e301dbbb7 and 0aa9d0124Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.