# CVE-2026-108561: Revive Adserver stored cross-site scripting in report date controls

Source: https://junglewise.ai/threats/cve-2026-108561-a-stored-cross-site-scripting-vulnerability-in-the-report-date  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-108561 · Severity: medium · CVSS 6.1 · Published 2026-11-11

Revive Adserver is an advertising management platform used to serve and track digital ads. A stored cross-site scripting (XSS) vulnerability in its report date-selection controls allows an attacker to inject malicious JavaScript that executes in users' browsers when they view reports. An unauthenticated attacker can trick a victim into clicking a crafted link and re-authenticating, after which the injected code runs both immediately and on future report views.

Technologies: [Revive Adserver](https://junglewise.ai/threats/technologies/revive-adserver-1). Vendors: [Revive](https://junglewise.ai/threats/vendors/revive).

## Quick answers

**Is CVE-2026-108561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108561 being exploited in the wild.

**How severe is CVE-2026-108561?** Medium severity, with a CVSS score of 6.1, published 11 November 2026.

**Which products and versions are affected?** Revive Adserver 6.0.8 and earlier.

**Is there a fix for CVE-2026-108561?** Yes: fixed in 6.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108561 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108561?** Check whether you run Revive Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.0.9

## Technical details

A stored XSS vulnerability exists in the report date-selection controls where the period_preset parameter is saved to the session and inserted into JavaScript without proper JSON encoding. An unauthenticated attacker can craft a malicious URL that, when visited by a victim who completes normal reauthentication, stores an attacker-controlled payload that executes on initial and subsequent report views. The vulnerability is fixed in version 6.0.9 through appropriate JSON encoding of date-selection values in the JavaScript context.

## Affected products

- Revive Adserver 6.0.8 and earlier

## Timeline

- 2026-11-11: disclosed

## References

- [https://hackerone.com/reports/4116433](https://hackerone.com/reports/4116433)

## Related threats

- [Revive Adserver authorization bypass in channel-edit.php](https://junglewise.ai/threats/cve-2026-82978-an-authorization-bypass-in-channel-edit-php-in-revive-adserver-6)
- [Revive Adserver CSRF in tracker modification](https://junglewise.ai/threats/cve-2026-77168-a-cross-site-request-forgery-vulnerability-in-tracker-invocation)
- [Revive Adserver authorization bypass in campaign-zone linking](https://junglewise.ai/threats/cve-2026-68486-an-authorization-bypass-in-campaign-zone-linking-in-revive)
- [Revive Adserver authorization bypass in website listing](https://junglewise.ai/threats/cve-2026-68485-an-authorization-bypass-in-website-index-php-in-revive-adserver-6)
- [Revive Adserver reflected cross-site scripting in popup options](https://junglewise.ai/threats/cve-2026-108565-a-reflected-cross-site-scripting-vulnerability-in-the-popup)