Revive Adserver: Reflected cross-site scripting in updates-history.php
Summary
Revive Adserver 6.0.8 and earlier contains a reflected cross-site scripting (XSS) vulnerability in updates-history.php. Attacker-controlled values are placed into XML command attributes without proper encoding, so injected JavaScript can run in a victim's browser. An unauthenticated attacker can exploit this by tricking a user into opening a crafted URL, because a session check omits GET xajax requests; authenticated administrator requests also reach the unsafe output.
Affected
- Revive Adserver 0 to 6.0.8
- Revive Adserver versions before 6.0.9
Fixed in
- Revive Adserver 6.0.9 (according to the CVE description; vendor advisory not confirmed)
Workaround
Unknown.
- Interim option (not from the vendor): restrict access to the updates-history endpoint via reverse proxy or WAF, after testing that the admin interface is not affected.
Exploitation
- OffSeq lists the CVE as not known to be exploited.
- No public proof of concept was found in the research; this does not rule one out.
Our recommendation
- Upgrade Revive Adserver to 6.0.9 or later in the next maintenance window; this release also covers other related XSS fixes.
- Verify the installed version in the admin interface or the installed files.
- Check whether administrators have followed links from untrusted sources, and warn them not to open unknown links while logged in.
- Monitor for unusual admin activity until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-108560 www.cve.org
- HackerOne report 4075098 hackerone.com
- OffSeq threat entry CVE-2026-108560 radar.offseq.com
- Revive Adserver on Wikipedia en.wikipedia.org
- CVE mirror threatint CVE-2026-108560 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:30.
Original description (NVD)
A reflected cross-site scripting vulnerability in updates-history.php in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to visit a crafted URL. Attacker-controlled values are included in XML command attributes without appropriate encoding, allowing injection of executable XHTML into the response. The preliminary session check omits GET xajax requests, exposing an unauthenticated attack path, while authenticated administrator requests also reach the unsafe output. The issue is fixed in Revive Adserver 6.0.9 by applying the session check to both GET and POST requests and encoding XML command attribute values in both response serializers.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.