CVE-2026-107800: medium-severity vulnerability in banq jivejdon
Jivejdon through 5.0 Stored XSS via Private Short Messages
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1
exploitation probability
—
observed exploitation
nono source reports it
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
banq · jivejdonRelated CVEs — banq jivejdon
In the same product, most dangerous first.
CVE-2026-107831MEDIUMJivejdon through 5.0 CSRF via GET-based Account and Thread ActionsEPSS —CVE-2026-107830MEDIUMJivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS EndpointEPSS —CVE-2026-107829HIGHJivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSqlEPSS —CVE-2026-107828MEDIUMJivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth LoginEPSS —CVE-2026-107801MEDIUMJivejdon through 5.0 Stored XSS via Attachment Upload Content-TypeEPSS —CVE-2026-107799MEDIUMJivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message RenderingEPSS —
References
https://github.com/banq/jivejdonhttps://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/shortmessage/receiveshortmessage.jsp#L63https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/form/ShortMessageForm.java#L89-L91https://github.com/banq/jivejdon/issues/28https://www.vulncheck.com/advisories/jivejdon-through-5.0-stored-xss-via-private-short-messages