Revive Adserver: Reflected cross-site scripting in iframe invocation options
Summary
Revive Adserver 6.0.8 and earlier contains a reflected cross-site scripting vulnerability in the iframe invocation options for any-size zones. The frame_width and frame_height request parameters are placed into HTML attributes without encoding. An unauthenticated attacker can run JavaScript in the browser of a logged-in user by getting that user to open a crafted URL. The CVSS score is 6.1 (medium), with limited confidentiality and integrity impact and no availability impact.
Affected
- Revive Adserver 0 to 6.0.8
Fixed in
- Revive Adserver 6.0.9, which HTML-encodes the affected values in the invocation-option form fields
Workaround
Unknown.
Exploitation
- Not known to be exploited, according to OffSeq.
- No public proof of concept or exploit found in the sources checked. This is not conclusive.
- No CISA KEV entry found.
Our recommendation
- Upgrade all Revive Adserver instances to 6.0.9 or later, starting with internet-facing installations.
- Check the vendor download page for the 6.0.9 release, because no vendor advisory for this CVE was found.
- Until the upgrade is done, limit who can use the admin interface and tell admins not to open unknown links while logged in.
- Note that 6.0.9 also contains other fixes, for example CVE-2026-107662 (SQL injection, CVSS 8.8).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HackerOne report 3908050 hackerone.com
- Revive Adserver security page www.revive-adserver.com
- OffSeq radar: CVE-2026-108559 radar.offseq.com
- ThreatInt: CVE-2026-108559 cve.threatint.com
- OffSeq radar: CVE-2026-107662 (SQL injection) radar.offseq.com
- VulDB: Revive Adserver 6.0.9 fixes vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:28.
Original description (NVD)
A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.