CVE-2026-107799: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in banq jivejdon

CVE-2026-107799 describes a stored cross-site scripting vulnerability in the banq jivejdon product through version 5.0. The vulnerability arises because message bodies are rendered by messageListBody.jsp with filter="false" and default non-escaping filters, allowing authenticated users to inject unsanitized script code. This script executes in the context of any user viewing the forum thread, potentially leading to session hijacking or other script-based attacks.

The vulnerability allows authenticated attackers to inject and execute arbitrary scripts in the browsers of other users viewing the forum messages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other malicious activities within the context of the affected web application. The CVSS 4.0 score is 5.1 (medium severity), reflecting the need for user interaction and limited privileges required for exploitation.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting forum posting permissions or implementing additional input sanitization controls at the application or web server level to mitigate exploitation.