MEDIUMCVSS v3 6.1Vulnerability
CVE-2026-108558
A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss score
- 6.1
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 6.1
- Last source
- NVD
- Cvss version
- 3.0
- Cve id
- CVE-2026-108558
- Cvss vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- First seen by Signal
- 2026-11-11T19:44:24+00:00
- Name
- CVE-2026-108558
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Published at
- 2026-11-11T18:18:26.227
- Last modified
- 2026-11-11T18:18:26.227
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph