{"affected":[{"defaultStatus":"unaffected","product":"Adserver","source":"CNA: hackerone","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-108558","cwes":["CWE-79"],"description":"A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: hackerone","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"}],"modifiedAt":1794418237732,"publishedAt":1794418237732,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://hackerone.com/reports/3878649"}],"remediation":[],"revision":"f9f875547e3f090473764b58c36d81da5261e77f6f99604794fea17e01a50e83","sources":[{"modifiedAt":1794418237732,"name":"CNA: hackerone","retrievedAt":1794420659237,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108558"}],"ssvc":null,"status":"published","title":"CVE-2026-108558","updatedAt":1794420659237}