CVE-2026-108561

Revive Adserver versions 6.0.8 and earlier are vulnerable to a stored cross-site scripting (XSS) vulnerability in the report date-selection controls. An unauthenticated attacker can save an attacker-controlled period_preset value into a victim's session. Because this value is inserted into JavaSc...

Revive Adserver: Stored XSS in report date selection

A stored cross-site scripting vulnerability was discovered in the date-selection controls of standard reports. A crafted period preset value could be saved in a user's session and inserted into JavaScript without proper encoding, allowing malicious code to execute during report views. The...