{"id":"CVE-2026-108564","kind":"vulnerability","aliases":["CVE-2026-108564"],"related":[],"title":"Revive Adserver: reflected XSS in invocation-tag generator via banner identifier","description":"A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.","summary":"Revive Adserver's invocation-tag generation interface reflects an attacker-supplied banner identifier into HTML form fields without encoding, when Direct Selection is enabled. An attacker who gets an logged-in user to open a crafted URL can run JavaScript in that user's browser session.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Revive Adserver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","revive-adserver","self-hosted"],"not_affected_if":["default-config","direct-selection-disabled"],"how_to_check":"- Check the installed Revive Adserver version in the admin footer or the package files; versions `6.0.8` and earlier are affected.\n- Check whether Direct Selection is enabled in the Revive Adserver settings (it is disabled by default).","fix":"- Revive Adserver: upgrade to `6.0.9`, which HTML-encodes banner identifier values in the invocation-option form fields.","status":"open","published_at":"2026-11-11T18:18:27+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:42+00:00","updated_at":"2026-11-11T18:29:42+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T18:29:42Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: upgrade to `6.0.9`, which HTML-encodes banner identifier values in the invocation-option form fields.","reach":"internet","title":"Revive Adserver: reflected XSS in invocation-tag generator via banner identifier","impact":"medium","summary":"Revive Adserver's invocation-tag generation interface reflects an attacker-supplied banner identifier into HTML form fields without encoding, when Direct Selection is enabled. An attacker who gets an logged-in user to open a crafted URL can run JavaScript in that user's browser session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"JavaScript runs in an authenticated admin's browser session.","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version in the admin footer or the package files; versions `6.0.8` and earlier are affected.\n- Check whether Direct Selection is enabled in the Revive Adserver settings (it is disabled by default).","plain_action":"","product_name":"Revive Adserver","needs_analyst":false,"not_affected_if":["default-config","direct-selection-disabled"],"who_is_affected":"Only installations of Revive Adserver 6.0.8 and earlier with Direct Selection turned on are exposed. Attackers need to lure a logged-in administrator or user to a crafted link. Installations with Direct Selection disabled, the default, are not affected by this issue.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4655,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108564':15A,18A '-2026':14A,17A '6.0.8':95C '6.0.9':153C 'adserv':2A,25B,30B,94C,152C 'adserver':20A 'allow':98C 'appropri':138C 'attack':40B,56B,101C,126C 'attacker-control':125C 'attacker-suppli':39B 'authent':107C 'banner':11A,42B,128C,158C 'browser':76B,110C 'control':127C 'craft':67B,117C 'cross':81C 'cross-sit':80C 'cve':13A,16A 'default':145C 'direct':51B,120C,140C 'disabl':143C 'earlier':97C 'enabl':54B,123C 'encod':49B,139C,157C 'execut':103C 'field':47B,136C,167C 'fix':149C 'form':46B,135C,166C 'generat':9A,35B,90C 'get':58B 'host':28B 'html':45B,134C,156C 'html-encod':155C 'identifi':12A,43B,129C,159C 'includ':132C 'interfac':36B,91C 'invoc':7A,33B,88C,164C 'invocation-opt':163C 'invocation-tag':6A,32B,87C 'issu':147C 'javascript':71B,104C 'log':61B 'logged-in':60B 'open':65B 'option':165C 'persuad':112C 'php':22B 'reflect':3A,37B,79C 'reviv':1A,24B,29B,93C,151C 'revive':19A 'revive-adserv':23B 'run':70B 'script':83C 'select':52B,121C,141C 'self':27B 'self-host':26B 'session':77B 'site':82C 'suppli':41B 'tag':8A,34B,89C 'unauthent':100C 'url':68B,118C 'user':63B,74B,108C 'valu':160C 'via':10A 'visit':115C 'vulner':84C 'without':48B,137C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Only installations of Revive Adserver 6.0.8 and earlier with Direct Selection turned on are exposed. Attackers need to lure a logged-in administrator or user to a crafted link. Installations with Direct Selection disabled, the default, are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adserver","reviveadserver"],"ptokens":["adserver","revive"],"labels":["medium","other","php","reviveadserver","selfhosted","vendor"],"campaign_type":null,"search_a":"'-108564':15A,18A '-2026':14A,17A 'adserv':2A 'adserver':20A 'banner':11A 'cve':13A,16A 'generat':9A 'identifi':12A 'invoc':7A 'invocation-tag':6A 'reflect':3A 'reviv':1A 'revive':19A 'tag':8A 'via':10A 'xss':4A","search_b":"'adserv':25B,30B 'attack':40B,56B 'attacker-suppli':39B 'banner':42B 'browser':76B 'craft':67B 'direct':51B 'enabl':54B 'encod':49B 'field':47B 'form':46B 'generat':35B 'get':58B 'host':28B 'html':45B 'identifi':43B 'interfac':36B 'invoc':33B 'invocation-tag':32B 'javascript':71B 'log':61B 'logged-in':60B 'open':65B 'php':22B 'reflect':37B 'reviv':24B,29B 'revive-adserv':23B 'run':70B 'select':52B 'self':27B 'self-host':26B 'session':77B 'suppli':41B 'tag':34B 'url':68B 'user':63B,74B 'without':48B","search_c":"'6.0.8':95C '6.0.9':153C 'adserv':94C,152C 'allow':98C 'appropri':138C 'attack':101C,126C 'attacker-control':125C 'authent':107C 'banner':128C,158C 'browser':110C 'control':127C 'craft':117C 'cross':81C 'cross-sit':80C 'default':145C 'direct':120C,140C 'disabl':143C 'earlier':97C 'enabl':123C 'encod':139C,157C 'execut':103C 'field':136C,167C 'fix':149C 'form':135C,166C 'generat':90C 'html':134C,156C 'html-encod':155C 'identifi':129C,159C 'includ':132C 'interfac':91C 'invoc':88C,164C 'invocation-opt':163C 'invocation-tag':87C 'issu':147C 'javascript':104C 'option':165C 'persuad':112C 'reflect':79C 'reviv':93C,151C 'script':83C 'select':121C,141C 'site':82C 'tag':89C 'unauthent':100C 'url':118C 'user':108C 'valu':160C 'visit':115C 'vulner':84C 'without':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108564","severity":null,"published_at":"2026-11-11T18:18:27+00:00","modified_at":"2026-11-11T18:18:27+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}