EUVD-2026-123621

A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-si...

CVE-2026-108559

Revive Adserver versions 6.0.8 and earlier are vulnerable to a reflected cross-site scripting (XSS) flaw in the iframe invocation options. The root cause is the inclusion of the frame_width and frame_height request parameters in HTML attributes without proper encoding when generating invocation t...

Revive Adserver: Reflected XSS via invocation iFrame size fields

A reflected cross-site scripting vulnerability was discovered in iframe invocation options. The frame width and height parameters were included in HTML attributes without proper encoding when generating invocation tags for any-size zones. This vulnerability was resolved by implementing HTML...

CVE-2026-50740

A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks...

CVE-2026-50740: Improper Neutralization of Input During Web Page Generation

A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks...