CVE-2026-108565 · Package
NO FIX YET · SEE WHAT TO DO
Revive Adserver 6.0.8 and earlier puts the top, left, timeout and delay URL parameters into HTML attributes without encoding them. A crafted link can run JavaScript in the browser of a logged-in user who opens it.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Revive Adserver 6.0.8 or earlier with at least one popup zone. The exposure is limited to authenticated administrators or users who can be tricked into opening a crafted link, and the popup zone is normally created through the administrator API rather than the standard interface. Installations on 6.0.9 or later, or without popup zones, are not affected.
Not affected if no-popup-zones, version-6.0.9-or-later
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are affected.6.0.9, which HTML-encodes the affected popup option values.A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.