Vulnerability record/PUBLISHED/Published Nov 11, 2026 17:30:37 UTC

CVE-2026-108558

A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.

Base score6.1/ 10

SeverityMediumCVSS 3.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionRequiredUI

ScopeChangedS

Confidentiality impactLowC

Integrity impactLowI

Availability impactNoneA

CVSS vector stringCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityhackerone

Last updatedNov 11, 2026 17:30:37 UTC

PublishedNov 11, 2026 17:30:37 UTC

ReservedOct 10, 2026 15:00:00 UTC

Credits

Patrick Lang (7YR)