REVIVE ADSERVER · CVE-2026-108558 · Other
NO FIX YET · SEE WHAT TO DO
Revive Adserver's conversion-statistics pages reflect unencoded input from a crafted URL into the page. An attacker who tricks a logged-in user into opening that link can run JavaScript in the user's browser session.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Revive Adserver 6.0.8 or earlier, where staff or advertisers log into the admin interface. The flaw needs a victim to open a crafted link while logged in, so public-only ad serving is less exposed. unknown whether managed hosting has already patched.
Not affected if managed-hosting, version-6.0.9-or-later
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are in the affected range.6.0.9.A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.