Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108559

Quick assessment

Affected
Revive Adserver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Revive Adserver 6.0.8 及更早版本在 iframe 调用选项中存在反射型跨站脚本（XSS）漏洞。该漏洞允许未认证的攻击者通过诱导已认证用户访问精心构造的 URL，从而在用户的浏览器中执行恶意 JavaScript 代码。当为任意尺寸的广告区域生成调用标签时， 和 请求参数被直接嵌入 HTML 属性中，而未进行适当的编码处理。该问题已在 Revive Adserver 6.0.9 中修复，修复方案是对调用选项表单字段中的受影响值进行 HTML 编码。

AI Predicted 6.1 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
Revive Adserver ≤ 6.0.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108559

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Revive Adserver 0 ~ 6.0.8 -

II. Public POCs for CVE-2026-108559

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108559

请登录查看更多情报信息。

Other References for CVE-2026-108559 (1)

Same Patch Batch · Revive · 2026-11-11 · 14 CVEs total

CVE-2026-77168 Revive Adserver 6.0.8 及以下版本跨站请求伪造漏洞
CVE-2026-108564 Revive Adserver 6.0.8 及之前版本反射型 XSS 漏洞
CVE-2026-108561 Revive Adserver 6.0.8 及之前版本存储型跨站脚本漏洞
CVE-2026-108558 Revive Adserver 6.0.8 及更早版本跨站脚本漏洞
CVE-2026-108565 Revive Adserver 6.0.8 及更早版本反射型跨站脚本漏洞
CVE-2026-108560 Revive Adserver 6.0.8 及更早版本反射型 XSS 漏洞
CVE-2026-108562 Revive Adserver 6.0.8 及之前版本存储型 XSS 漏洞
CVE-2026-108563 Revive Adserver 6.0.8 及以下版本电子表格公式注入漏洞
CVE-2026-107247 Revive 6.0.0-6.0.8 授权绕过漏洞
CVE-2026-107662 Revive Adserver 6.0.8 及更早版本盲 SQL 注入漏洞
CVE-2026-82978 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68486 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68485 Revive Adserver 6.0.8 及之前版本授权绕过漏洞

IV. Related Vulnerabilities

Same product: Adserver
Same vendor: Revive
Same weakness: CWE-79