{"vulnerability": "CVE-2026-108564", "sightings": [{"uuid": "a9209a81-f6d1-48c7-bccf-dce0f2e79c30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108564", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117599283843018725", "content": "CVE-2026-108564  A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108564https://hackerone.com/reports/3942028#Revive #Adserver#CVE_2026_108564#bot", "creation_timestamp": "2026-11-11T18:44:26.572597Z"}]}