CVE-2026-107830mediumCWE-799

CVE-2026-107830: medium-severity vulnerability in banq jivejdon

Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Published

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9
exploitation probability
—
observed exploitation
nono source reports it
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
banq · jivejdon
Related CVEs — banq jivejdon

In the same product, most dangerous first.

CVE-2026-107831MEDIUMJivejdon through 5.0 CSRF via GET-based Account and Thread ActionsEPSS —CVE-2026-107829HIGHJivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSqlEPSS —CVE-2026-107828MEDIUMJivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth LoginEPSS —CVE-2026-107801MEDIUMJivejdon through 5.0 Stored XSS via Attachment Upload Content-TypeEPSS —CVE-2026-107800MEDIUMJivejdon through 5.0 Stored XSS via Private Short MessagesEPSS —CVE-2026-107799MEDIUMJivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message RenderingEPSS —
References
https://github.com/banq/jivejdonhttps://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79https://github.com/banq/jivejdon/issues/28https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-rate-limiting-via-account-smsvraction-sms-endpoint