https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 02:38:42 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-108564 <p>A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user&#39;s browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.</p> <p>A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user&#39;s browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-108564 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0565 <p><strong>Affected:</strong> unknown Revive Adserver Vulnerabilities</p> <p>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: &lt;= 6.0.8 Versions not affected: &gt;= 6.0.9 Website: https://www.revive-adserver.com/ ========================================================================</p> <p>======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------</p> <p>Description -----------</p> <p>Resolution ----------</p> <p>References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html</p> <p>========================================================…</p> <p><strong>Affected:</strong> unknown Revive Adserver Vulnerabilities</p> <p>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: &lt;= 6.0.8 Versions not affected: &gt;= 6.0.9 Website: https://www.revive-adserver.com/ ========================================================================</p> <p>======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------</p> <p>Description -----------</p> <p>Resolution ----------</p> <p>References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html</p> <p>========================================================…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0565 https://vulnerability.circl.lu/vuln/ghsa-pfrc-phx7-58v8 <p>A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user&#39;s browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.</p> <p>A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user&#39;s browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.</p> https://vulnerability.circl.lu/vuln/ghsa-pfrc-phx7-58v8