Revive Adserver: Stored cross-site scripting in report date-selection controls
Summary
Revive Adserver, an open-source advertising server, contains a stored cross-site scripting (XSS) vulnerability in the report date-selection controls. An attacker can store a crafted period_preset value in a victim's session, which is then inserted into JavaScript without proper encoding. The attacker must persuade an authenticated administrator or user to follow a crafted report URL and log in again; the script then runs on the report view and on later views that use the stored defaults.
Affected
- Revive Adserver 6.0.8 and earlier (0 to 6.0.8)
Fixed in
- Revive Adserver 6.0.9 (per the CVE description; vendor advisory not yet confirmed)
Workaround
- No vendor workaround found.
- Limit access to the Revive admin and reporting interface to trusted users.
- Do not open Revive report links from untrusted sources until patched.
Exploitation
- Unknown. No public proof of concept found.
- No known exploitation; not listed in CISA KEV according to a third-party index (not checked directly).
Our recommendation
- Upgrade Revive Adserver to 6.0.9 or later during the next maintenance window, after confirming the fixed version in the vendor advisory.
- Check all Revive deployments at the same time, as 6.0.9 appears to fix several related XSS issues.
- Warn administrators not to open report links from untrusted sources until the update is applied.
- Review whether the admin interface is internet-facing and restrict access where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-108561 www.cve.org
- HackerOne report 4116433 hackerone.com
- OffSeq Radar: CVE-2026-108561 radar.offseq.com
- Revive SA-2021-002 (related earlier period_preset issue) www.revive-adserver.com
- Wikipedia: Revive Adserver en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:31.
Original description (NVD)
A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to follow a crafted report URL and complete normal reauthentication. An attacker-controlled period_preset value can be saved in the victim's session and inserted into JavaScript without appropriate encoding. The payload can execute on the initial report view and subsequent report views using the stored defaults. The issue is fixed in Revive Adserver 6.0.9 by applying JSON encoding appropriate for the JavaScript context to date-selection values.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.