REVIVE ADSERVER · CVE-2026-108561 · Package
NO FIX YET · SEE WHAT TO DO
Revive Adserver's report date-selection controls store an attacker-supplied period_preset value in the victim's session and insert it into JavaScript without encoding. A victim who opens a crafted report URL and reauthenticates runs the attacker's script in their browser, on that view and later report views.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted Revive Adserver 6.0.8 or earlier with the reporting interface in use. The attack needs a victim to follow a crafted link and sign in again, so exposure is highest where administrators use reports from untrusted links. Installations already on 6.0.9 or later are not affected.
Not affected if version-6.0.9-or-later
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are affected.6.0.9, which applies JSON encoding to date-selection values.A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to follow a crafted report URL and complete normal reauthentication. An attacker-controlled period_preset value can be saved in the victim's session and inserted into JavaScript without appropriate encoding. The payload can execute on the initial report view and subsequent report views using the stored defaults. The issue is fixed in Revive Adserver 6.0.9 by applying JSON encoding appropriate for the JavaScript context to date-selection values.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.