{"id":"CVE-2026-108558","kind":"vulnerability","aliases":["CVE-2026-108558"],"related":[],"title":"Revive Adserver: crafted link runs script in logged-in users' browsers","description":"A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.","summary":"Revive Adserver's conversion-statistics pages reflect unencoded input from a crafted URL into the page. An attacker who tricks a logged-in user into opening that link can run JavaScript in the user's browser session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Revive Adserver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","revive-adserver","self-hosted"],"not_affected_if":["managed-hosting","version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version; versions `6.0.8` and earlier are in the affected range.\n- Look for the Revive Adserver installation and its version file or admin footer.","fix":"- Revive Adserver: upgrade to `6.0.9`.","status":"open","published_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:34+00:00","updated_at":"2026-11-11T18:29:34+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T18:29:34Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: upgrade to `6.0.9`.","reach":"internet","title":"Revive Adserver: crafted link runs script in logged-in users' browsers","impact":"medium","summary":"Revive Adserver's conversion-statistics pages reflect unencoded input from a crafted URL into the page. An attacker who tricks a logged-in user into opening that link can run JavaScript in the user's browser session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in a logged-in admin's browser session.","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version; versions `6.0.8` and earlier are in the affected range.\n- Look for the Revive Adserver installation and its version file or admin footer.","plain_action":"","product_name":"Revive Adserver","needs_analyst":false,"not_affected_if":["managed-hosting","version-6.0.9-or-later"],"who_is_affected":"Sites running Revive Adserver 6.0.8 or earlier, where staff or advertisers log into the admin interface. The flaw needs a victim to open a crafted link while logged in, so public-only ad serving is less exposed. unknown whether managed hosting has already patched.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4667,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108558':15A,18A '-2026':14A,17A '6.0.8':84C '6.0.9':148C 'adserv':2A,25B,30B,83C,147C 'adserver':20A 'advertis':114C 'affect':137C 'allow':87C,122C 'appropri':131C 'attack':47B,90C 'authent':96C 'browser':12A,66B,99C 'check':111C 'convers':33B,78C 'conversion-statist':32B,77C 'correct':152C 'craft':3A,41B,106C 'cross':71C 'cross-sit':70C 'cve':13A,16A 'earlier':86C 'encod':132C 'execut':92C 'fix':144C 'format':161C 'host':28B 'hour':139C,158C 'html':128C 'identifi':115C,121C,154C 'incorrect':109C 'input':38B,125C 'instead':116C 'issu':136C,142C 'javascript':61B,93C 'link':4A,58B 'log':9A,52B 'logged-in':8A,51B 'malici':123C 'normalis':156C 'open':56B 'output':129C,135C 'ownership':110C 'page':35B,45B,80C 'paramet':140C,159C 'persuad':101C 'php':22B 'reach':127C 'reflect':36B,69C 'relat':134C 'reviv':1A,24B,29B,82C,146C 'revive':19A 'revive-adserv':23B 'run':5A,60B 'script':6A,73C 'self':27B 'self-host':26B 'session':67B 'site':72C 'statist':34B,79C 'suppli':119C 'trick':49B 'unauthent':89C 'unencod':37B 'url':42B,107C 'user':11A,54B,64B,97C 'valid':112C,150C 'visit':104C 'vulner':74C 'websit':120C,124C,153C 'without':130C","nicknames":[],"mitigations":[],"who_affected":"Sites running Revive Adserver 6.0.8 or earlier, where staff or advertisers log into the admin interface. The flaw needs a victim to open a crafted link while logged in, so public-only ad serving is less exposed. unknown whether managed hosting has already patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adserver","reviveadserver"],"ptokens":["adserver","revive"],"labels":["medium","other","php","reviveadserver","selfhosted","vendor"],"campaign_type":null,"search_a":"'-108558':15A,18A '-2026':14A,17A 'adserv':2A 'adserver':20A 'browser':12A 'craft':3A 'cve':13A,16A 'link':4A 'log':9A 'logged-in':8A 'reviv':1A 'revive':19A 'run':5A 'script':6A 'user':11A","search_b":"'adserv':25B,30B 'attack':47B 'browser':66B 'convers':33B 'conversion-statist':32B 'craft':41B 'host':28B 'input':38B 'javascript':61B 'link':58B 'log':52B 'logged-in':51B 'open':56B 'page':35B,45B 'php':22B 'reflect':36B 'reviv':24B,29B 'revive-adserv':23B 'run':60B 'self':27B 'self-host':26B 'session':67B 'statist':34B 'trick':49B 'unencod':37B 'url':42B 'user':54B,64B","search_c":"'6.0.8':84C '6.0.9':148C 'adserv':83C,147C 'advertis':114C 'affect':137C 'allow':87C,122C 'appropri':131C 'attack':90C 'authent':96C 'browser':99C 'check':111C 'convers':78C 'conversion-statist':77C 'correct':152C 'craft':106C 'cross':71C 'cross-sit':70C 'earlier':86C 'encod':132C 'execut':92C 'fix':144C 'format':161C 'hour':139C,158C 'html':128C 'identifi':115C,121C,154C 'incorrect':109C 'input':125C 'instead':116C 'issu':136C,142C 'javascript':93C 'malici':123C 'normalis':156C 'output':129C,135C 'ownership':110C 'page':80C 'paramet':140C,159C 'persuad':101C 'reach':127C 'reflect':69C 'relat':134C 'reviv':82C,146C 'script':73C 'site':72C 'statist':79C 'suppli':119C 'unauthent':89C 'url':107C 'user':97C 'valid':112C,150C 'visit':104C 'vulner':74C 'websit':120C,124C,153C 'without':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108558","severity":null,"published_at":"2026-11-11T18:18:26+00:00","modified_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}