---
id: "CVE-2026-108565"
page: "https://infrastack.ai/live/CVE-2026-108565"
kind: "vulnerability"
aliases: ["CVE-2026-108565"]
title: "Revive Adserver: reflected script injection through popup option parameters"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "revive-adserver", "self-hosted"]
not_affected_if: ["no-popup-zones", "version-6.0.9-or-later"]
published_at: "2026-11-11T18:18:27+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108565", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# Revive Adserver: reflected script injection through popup option parameters

Link for people: https://infrastack.ai/live/CVE-2026-108565 (this .md is for agents)

Revive Adserver 6.0.8 and earlier puts the top, left, timeout and delay URL parameters into HTML attributes without encoding them. A crafted link can run JavaScript in the browser of a logged-in user who opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Revive Adserver version in the admin interface or its package files; versions `6.0.8` and earlier are affected.
- Look for existing popup zones created through the administrator API, since exploitation requires one.

## Fix

- Revive Adserver: move to `6.0.9`, which HTML-encodes the affected popup option values.

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108565

## From the sources

A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_