{"id":"CVE-2026-108562","kind":"vulnerability","aliases":["CVE-2026-108562"],"related":[],"title":"Revive Adserver: stored script injection via tracker names in maintenance page","description":"A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to execute JavaScript in an administrator's browser. A manager can store a malicious tracker name and cause the tracker to appear in the append-code maintenance results. When an administrator opens the affected maintenance page, the tracker name is included in HTML without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding tracker names when displaying the maintenance results.","summary":"A manager in Revive Adserver can save a tracker name containing JavaScript, which then appears unescaped on the append-code maintenance results page. When an administrator opens that page, the script runs in the administrator's browser.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","revive-adserver","self-hosted"],"not_affected_if":["no-manager-accounts","version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version; `6.0.8` and earlier are affected.\n- Review existing tracker names for HTML or script content.","fix":"- Revive Adserver: move to `6.0.9` or later.","status":"open","published_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:38+00:00","updated_at":"2026-11-11T18:29:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:38Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: move to `6.0.9` or later.","reach":"internet","title":"Revive Adserver: stored script injection via tracker names in maintenance page","impact":"medium","summary":"A manager in Revive Adserver can save a tracker name containing JavaScript, which then appears unescaped on the append-code maintenance results page. When an administrator opens that page, the script runs in the administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in an administrator's browser, enabling session or account takeover.","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version; `6.0.8` and earlier are affected.\n- Review existing tracker names for HTML or script content.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.0.9-or-later","no-manager-accounts"],"who_is_affected":"Sites running Revive Adserver 6.0.8 or earlier where users with the manager role can create trackers. The attacker must be an authenticated manager, and the script runs when an administrator opens the maintenance page. Installations where only trusted administrators hold manager access carry lower risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4654,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108562':14A,17A '-2026':13A,16A '6.0.8':76C '6.0.9':137C 'administr':52B,61B,88C,114C 'adserv':2A,22B,30B,75C,136C 'affect':117C 'allow':79C 'appear':40B,104C 'append':45B,108C 'append-cod':44B,107C 'appropri':128C 'authent':81C 'browser':63B,90C 'caus':100C 'code':46B,109C 'contain':36B 'cross':67C 'cross-sit':66C 'cve':12A,15A 'display':145C 'earlier':78C 'encod':129C,141C 'execut':84C 'fix':133C 'host':25B 'html':126C,140C 'html-encod':139C 'includ':124C 'inject':5A 'issu':131C 'javascript':37B,85C 'mainten':10A,47B,110C,118C,147C 'maintenance-appendcode-check.php':72C 'malici':96C 'manag':27B,82C,92C 'name':8A,35B,98C,122C,143C 'open':53B,115C 'packag':18B 'page':11A,49B,55B,119C 'php':19B 'result':48B,111C,148C 'reviv':1A,21B,29B,74C,135C 'revive-adserv':20B 'run':58B 'save':32B 'script':4A,57B,69C 'self':24B 'self-host':23B 'site':68C 'store':3A,65C,94C 'tracker':7A,34B,97C,102C,121C,142C 'unescap':41B 'via':6A 'vulner':70C 'without':127C","nicknames":[],"mitigations":[],"who_affected":"Sites running Revive Adserver 6.0.8 or earlier where users with the manager role can create trackers. The attacker must be an authenticated manager, and the script runs when an administrator opens the maintenance page. Installations where only trusted administrators hold manager access carry lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-108562':14A,17A '-2026':13A,16A 'adserv':2A 'cve':12A,15A 'inject':5A 'mainten':10A 'name':8A 'page':11A 'reviv':1A 'script':4A 'store':3A 'tracker':7A 'via':6A","search_b":"'administr':52B,61B 'adserv':22B,30B 'appear':40B 'append':45B 'append-cod':44B 'browser':63B 'code':46B 'contain':36B 'host':25B 'javascript':37B 'mainten':47B 'manag':27B 'name':35B 'open':53B 'packag':18B 'page':49B,55B 'php':19B 'result':48B 'reviv':21B,29B 'revive-adserv':20B 'run':58B 'save':32B 'script':57B 'self':24B 'self-host':23B 'tracker':34B 'unescap':41B","search_c":"'6.0.8':76C '6.0.9':137C 'administr':88C,114C 'adserv':75C,136C 'affect':117C 'allow':79C 'appear':104C 'append':108C 'append-cod':107C 'appropri':128C 'authent':81C 'browser':90C 'caus':100C 'code':109C 'cross':67C 'cross-sit':66C 'display':145C 'earlier':78C 'encod':129C,141C 'execut':84C 'fix':133C 'html':126C,140C 'html-encod':139C 'includ':124C 'issu':131C 'javascript':85C 'mainten':110C,118C,147C 'maintenance-appendcode-check.php':72C 'malici':96C 'manag':82C,92C 'name':98C,122C,143C 'open':115C 'page':119C 'result':111C,148C 'reviv':74C,135C 'script':69C 'site':68C 'store':65C,94C 'tracker':97C,102C,121C,142C 'vulner':70C 'without':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108562","severity":null,"published_at":"2026-11-11T18:18:26+00:00","modified_at":"2026-11-11T18:18:26+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}