{"id":"CVE-2026-108565","kind":"vulnerability","aliases":["CVE-2026-108565"],"related":[],"title":"Revive Adserver: reflected script injection through popup option parameters","description":"A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values.","summary":"Revive Adserver 6.0.8 and earlier puts the top, left, timeout and delay URL parameters into HTML attributes without encoding them. A crafted link can run JavaScript in the browser of a logged-in user who opens it.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","revive-adserver","self-hosted"],"not_affected_if":["no-popup-zones","version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version in the admin interface or its package files; versions `6.0.8` and earlier are affected.\n- Look for existing popup zones created through the administrator API, since exploitation requires one.","fix":"- Revive Adserver: move to `6.0.9`, which HTML-encodes the affected popup option values.","status":"open","published_at":"2026-11-11T18:18:27+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:42+00:00","updated_at":"2026-11-11T18:29:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:42Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: move to `6.0.9`, which HTML-encodes the affected popup option values.","reach":"internet","title":"Revive Adserver: reflected script injection through popup option parameters","impact":"medium","summary":"Revive Adserver 6.0.8 and earlier puts the top, left, timeout and delay URL parameters into HTML attributes without encoding them. A crafted link can run JavaScript in the browser of a logged-in user who opens it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"JavaScript runs in a logged-in administrator's browser session","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version in the admin interface or its package files; versions `6.0.8` and earlier are affected.\n- Look for existing popup zones created through the administrator API, since exploitation requires one.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.0.9-or-later","no-popup-zones"],"who_is_affected":"Sites running Revive Adserver 6.0.8 or earlier with at least one popup zone. The exposure is limited to authenticated administrators or users who can be tricked into opening a crafted link, and the popup zone is normally created through the administrator API rather than the standard interface. Installations on 6.0.9 or later, or without popup zones, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4661,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108565':12A,15A '-2026':11A,14A '6.0.8':26B,76C '6.0.9':148C 'administr':128C 'adserv':2A,20B,25B,75C,147C 'affect':154C 'allow':79C 'api':129C 'appropri':114C 'attack':82C 'attribut':40B,112C 'authent':88C 'browser':52B,91C 'craft':45B,98C 'creat':125C 'creation':139C 'cross':64C 'cross-sit':63C 'cve':10A,13A 'delay':35B,105C 'earlier':28B,78C 'encod':42B,115C,152C 'execut':84C 'exist':119C 'exploit':116C 'fix':144C 'host':23B 'html':39B,111C,151C 'html-encod':150C 'includ':109C 'inject':5A 'interfac':140C 'invoc':71C 'issu':142C 'javascript':49B,85C 'left':32B,102C 'link':46B 'log':56B 'logged-in':55B 'normal':136C 'offer':133C 'open':60B 'option':8A,72C,156C 'packag':16B 'paramet':9A,37B,107C 'persuad':93C 'php':17B 'popup':7A,70C,120C,155C 'put':29B 'reflect':3A,62C 'request':106C 'requir':117C 'reviv':1A,19B,24B,74C,146C 'revive-adserv':18B 'run':48B 'script':4A,66C 'self':22B 'self-host':21B 'site':65C 'timeout':33B,103C 'top':31B,101C 'unauthent':81C 'url':36B,99C 'user':58B,89C 'valu':157C 'visit':96C 'vulner':67C 'without':41B,113C 'zone':121C,138C 'zone-cr':137C","nicknames":[],"mitigations":[],"who_affected":"Sites running Revive Adserver 6.0.8 or earlier with at least one popup zone. The exposure is limited to authenticated administrators or users who can be tricked into opening a crafted link, and the popup zone is normally created through the administrator API rather than the standard interface. Installations on 6.0.9 or later, or without popup zones, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-108565':12A,15A '-2026':11A,14A 'adserv':2A 'cve':10A,13A 'inject':5A 'option':8A 'paramet':9A 'popup':7A 'reflect':3A 'reviv':1A 'script':4A","search_b":"'6.0.8':26B 'adserv':20B,25B 'attribut':40B 'browser':52B 'craft':45B 'delay':35B 'earlier':28B 'encod':42B 'host':23B 'html':39B 'javascript':49B 'left':32B 'link':46B 'log':56B 'logged-in':55B 'open':60B 'packag':16B 'paramet':37B 'php':17B 'put':29B 'reviv':19B,24B 'revive-adserv':18B 'run':48B 'self':22B 'self-host':21B 'timeout':33B 'top':31B 'url':36B 'user':58B 'without':41B","search_c":"'6.0.8':76C '6.0.9':148C 'administr':128C 'adserv':75C,147C 'affect':154C 'allow':79C 'api':129C 'appropri':114C 'attack':82C 'attribut':112C 'authent':88C 'browser':91C 'craft':98C 'creat':125C 'creation':139C 'cross':64C 'cross-sit':63C 'delay':105C 'earlier':78C 'encod':115C,152C 'execut':84C 'exist':119C 'exploit':116C 'fix':144C 'html':111C,151C 'html-encod':150C 'includ':109C 'interfac':140C 'invoc':71C 'issu':142C 'javascript':85C 'left':102C 'normal':136C 'offer':133C 'option':72C,156C 'paramet':107C 'persuad':93C 'popup':70C,120C,155C 'reflect':62C 'request':106C 'requir':117C 'reviv':74C,146C 'script':66C 'site':65C 'timeout':103C 'top':101C 'unauthent':81C 'url':99C 'user':89C 'valu':157C 'visit':96C 'vulner':67C 'without':113C 'zone':121C,138C 'zone-cr':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108565","severity":null,"published_at":"2026-11-11T18:18:27+00:00","modified_at":"2026-11-11T18:18:27+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}