REVIVE ADSERVER · CVE-2026-108564 · Other
NO FIX YET · SEE WHAT TO DO
Revive Adserver's invocation-tag generation interface reflects an attacker-supplied banner identifier into HTML form fields without encoding, when Direct Selection is enabled. An attacker who gets an logged-in user to open a crafted URL can run JavaScript in that user's browser session.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only installations of Revive Adserver 6.0.8 and earlier with Direct Selection turned on are exposed. Attackers need to lure a logged-in administrator or user to a crafted link. Installations with Direct Selection disabled, the default, are not affected by this issue.
Not affected if default-config, direct-selection-disabled
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are affected.6.0.9, which HTML-encodes banner identifier values in the invocation-option form fields.A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.