Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108558

Quick assessment

Affected
Revive Adserver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Revive Adserver 6.0.8 及更早版本的“转化统计”页面中存在一个反射型跨站脚本（XSS）漏洞。未认证的攻击者可通过诱使用户访问特制的 URL，在已认证用户的浏览器中执行恶意 JavaScript 代码。该漏洞源于所有权验证逻辑错误：系统错误地验证了广告商标识符，而非用户提供的网站标识符，导致恶意网站输入未经适当编码即可直接输出到 HTML 中。此外，与输出相关的另一个问题影响了"hour"（小时）参数。该问题已在 Revive Adserver 6.0.9 中修复，修复方案包括正确验证网站标识符，

AI Predicted 6.1 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
Revive Adserver ≤ 6.0.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108558

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Revive Adserver 0 ~ 6.0.8 -

II. Public POCs for CVE-2026-108558

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108558

请登录查看更多情报信息。

Other References for CVE-2026-108558 (1)

Same Patch Batch · Revive · 2026-11-11 · 14 CVEs total

CVE-2026-77168 Revive Adserver 6.0.8 及以下版本跨站请求伪造漏洞
CVE-2026-108564 Revive Adserver 6.0.8 及之前版本反射型 XSS 漏洞
CVE-2026-108561 Revive Adserver 6.0.8 及之前版本存储型跨站脚本漏洞
CVE-2026-108559 Revive Adserver 6.0.8 及以下版本反射型 XSS 漏洞
CVE-2026-108565 Revive Adserver 6.0.8 及更早版本反射型跨站脚本漏洞
CVE-2026-108560 Revive Adserver 6.0.8 及更早版本反射型 XSS 漏洞
CVE-2026-108562 Revive Adserver 6.0.8 及之前版本存储型 XSS 漏洞
CVE-2026-108563 Revive Adserver 6.0.8 及以下版本电子表格公式注入漏洞
CVE-2026-107247 Revive 6.0.0-6.0.8 授权绕过漏洞
CVE-2026-107662 Revive Adserver 6.0.8 及更早版本盲 SQL 注入漏洞
CVE-2026-82978 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68486 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68485 Revive Adserver 6.0.8 及之前版本授权绕过漏洞

IV. Related Vulnerabilities

Same product: Adserver
Same vendor: Revive
Same weakness: CWE-79