EUVD-2026-123627

Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet...

CVE-2026-108563

Revive Adserver versions 6.0.8 and earlier are vulnerable to a spreadsheet formula injection in conversion-tracking report exports. An unauthenticated attacker can submit conversion values that are written as formulas rather than plain text in the generated XLS workbook . When a user opens the ex...