CVE-2026-107800: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in banq jivejdon
Description
Jivejdon versions up to 5.0 contain a stored cross-site scripting (XSS) vulnerability in the private short message feature. Authenticated attackers can inject malicious scripts into message bodies because the application renders unfiltered content in receiveshortmessage.jsp. This allows execution of attacker-controlled code in the recipient's browser when the message is opened.
CVSS v4.0
Score 5.1medium
Affected software
banq
jivejdon
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107800 is a stored cross-site scripting vulnerability in banq's Jivejdon product through version 5.0. The flaw exists because receiveshortmessage.jsp renders private short message bodies without proper input neutralization. The function ToolsUtil.convertURL() does not sanitize script content, allowing authenticated attackers to embed malicious scripts in short messages. When a recipient opens such a message, the injected script executes in their browser context.
Potential Impact
An authenticated attacker can exploit this vulnerability to execute arbitrary script code in the context of the victim's browser when they open a crafted private short message. This can lead to session hijacking, information disclosure, or other actions permitted by the victim's browser privileges. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the need for user interaction and limited scope of impact.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening private short messages from untrusted sources. Vendors and administrators should monitor for updates and apply any official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-08T21:21:00.147Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac8135c2cdf04f6563b0c7d
Added to database: 10/08/2026, 22:04:12 UTC
Last enriched: 10/08/2026, 22:19:17 UTC
Last updated: 10/08/2026, 22:19:17 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.