Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108564

Quick assessment

Affected
Revive Adserver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Revive Adserver 6.0.8 及更早版本中的调用标签生成接口存在反射型跨站脚本（XSS）漏洞。该漏洞允许未认证的攻击者通过诱导已认证用户访问精心构造的 URL，从而在用户的浏览器中执行恶意 JavaScript 代码。当启用“直接选择”（Direct Selection）功能时，攻击者可控制的横幅标识符（banner identifier）会被直接嵌入 HTML 表单字段中，且未经过适当的编码处理。需要注意的是，“直接选择”功能默认处于禁用状态。该问题已在 Revive Adserver 6.0.9

AI Predicted 6.1 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Revive Adserver ≤ 6.0.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108564

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Revive Adserver 0 ~ 6.0.8 -

II. Public POCs for CVE-2026-108564

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108564

请登录查看更多情报信息。

Other References for CVE-2026-108564 (1)

Same Patch Batch · Revive · 2026-11-11 · 14 CVEs total

CVE-2026-77168 Revive Adserver 6.0.8 及以下版本跨站请求伪造漏洞
CVE-2026-108561 Revive Adserver 6.0.8 及之前版本存储型跨站脚本漏洞
CVE-2026-108558 Revive Adserver 6.0.8 及更早版本跨站脚本漏洞
CVE-2026-108559 Revive Adserver 6.0.8 及以下版本反射型 XSS 漏洞
CVE-2026-108565 Revive Adserver 6.0.8 及更早版本反射型跨站脚本漏洞
CVE-2026-108560 Revive Adserver 6.0.8 及更早版本反射型 XSS 漏洞
CVE-2026-108562 Revive Adserver 6.0.8 及之前版本存储型 XSS 漏洞
CVE-2026-108563 Revive Adserver 6.0.8 及以下版本电子表格公式注入漏洞
CVE-2026-107247 Revive 6.0.0-6.0.8 授权绕过漏洞
CVE-2026-107662 Revive Adserver 6.0.8 及更早版本盲 SQL 注入漏洞
CVE-2026-82978 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68486 Revive Adserver 6.0.8 及更早版本授权绕过漏洞
CVE-2026-68485 Revive Adserver 6.0.8 及之前版本授权绕过漏洞

IV. Related Vulnerabilities

Same product: Adserver
Same vendor: Revive
Same weakness: CWE-79