CVE-2026-108559 · Package
NO FIX YET · SEE WHAT TO DO
Revive Adserver 6.0.8 and earlier reflects the frame_width and frame_height request parameters into HTML attributes without encoding when generating invocation tags for any-size zones. An attacker who gets a logged-in user to visit a crafted URL can run JavaScript in that user's browser.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Revive Adserver 6.0.8 or earlier with the admin interface in use. The attack needs an authenticated admin or user to open a crafted link, so instances where no one signs in to the admin UI are lower risk. Hosted or managed Revive installs depend on the provider's patching.
Not affected if managed-hosting, no-admin-login
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are affected.frame_width and frame_height in the installed code.6.0.9, which HTML-encodes the affected values in the invocation-option form fields.A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.