Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-108562

Quick assessment

Affected

Revive Adserver

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Revive Adserver 6.0.8 及更早版本中的文件存在存储型跨站脚本（Stored XSS）漏洞。该漏洞允许已认证的管理员（Manager）在管理员（Administrator）的浏览器中执行恶意 JavaScript 代码。具体而言，管理员可存储一个恶意的追踪器（tracker）名称，使其出现在附加代码维护结果中。当管理员打开受影响的维护页面时，该追踪器名称会以未经适当编码的形式直接嵌入 HTML 中，从而触发脚本执行。此问题已在 Revive Adserver 6.0.9 中修复，修复方案是在显示

AI Predicted 5.4 Difficulty: Easy Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1203 · Exploitation for Client Execution

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Revive	Adserver	`≤ 6.0.8`	affected

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to execute JavaScript in an administrator's browser. A manager can store a malicious tracker name and cause the tracker to appear in the append-code maintenance results. When an administrator opens the affected maintenance page, the tracker name is included in HTML without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding tracker names when displaying the maintenance results.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Revive	Adserver	0 ~ 6.0.8	-

II. Public POCs for CVE-2026-108562

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-108562

请登录查看更多情报信息。

Other References for CVE-2026-108562 (1)

https://hackerone.com/reports/3826207

https://www.cve.org/CVERecord?id=CVE-2026-108562

Same Patch Batch · Revive · 2026-11-11 · 14 CVEs total

CVE-2026-77168		Revive Adserver 6.0.8 及以下版本跨站请求伪造漏洞
CVE-2026-108564		Revive Adserver 6.0.8 及之前版本反射型 XSS 漏洞
CVE-2026-108561		Revive Adserver 6.0.8 及之前版本存储型跨站脚本漏洞
CVE-2026-108558		Revive Adserver 6.0.8 及更早版本跨站脚本漏洞
CVE-2026-108559		Revive Adserver 6.0.8 及以下版本反射型 XSS 漏洞
CVE-2026-108565		Revive Adserver 6.0.8 及更早版本反射型跨站脚本漏洞
CVE-2026-108560		Revive Adserver 6.0.8 及更早版本反射型 XSS 漏洞
CVE-2026-108563		Revive Adserver 6.0.8 及以下版本电子表格公式注入漏洞
CVE-2026-107247		Revive 6.0.0-6.0.8 授权绕过漏洞
CVE-2026-107662		Revive Adserver 6.0.8 及更早版本盲 SQL 注入漏洞
CVE-2026-82978		Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68486		Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68485		Revive Adserver 6.0.8 及之前版本授权绕过漏洞

IV. Related Vulnerabilities

Same product: Adserver

Same vendor: Revive

Same weakness: CWE-79