Threat database

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.

CVE-2026-107830 is a medium severity vulnerability in the banq jivejdon product. It involves a lack of rate limiting on the unauthenticated /account/smsVRAction endpoint, allowing attackers to send unlimited SMS messages. This can be exploited to harass arbitrary phone numbers and exhaust the Tencent Cloud SMS balance associated with the operator. The vulnerability affects versions of jivejdon from commit e0306088 through commit ee67a65e. No patch or remediation information is provided.

Jivejdon versions up to 5.0 use a weak password storage method by hashing passwords with unsalted MD5. This vulnerability allows attackers who gain database access or exploit SQL injection flaws to crack user passwords using precomputed tables or GPU-accelerated attacks.

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.

Jivejdon versions up to 5.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this by uploading attachments with a malicious Content-Type, such as text/html, which the application serves inline. This allows execution of arbitrary JavaScript in the context of the application for users who view the shared link. The vulnerability has a medium severity with a CVSS score of 5.1.

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.

Jivejdon versions up to 5.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can inject malicious scripts into forum message bodies, which are rendered without proper sanitization. This causes the script to execute in the browsers of users viewing the affected threads. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

CVE-2026-107798 is a stored cross-site scripting (XSS) vulnerability in the banq jivejdon product. The flaw exists in the default-enabled TextStyle filter, which improperly neutralizes input by inserting unvalidated URLs into anchor href attributes. Authenticated attackers can exploit this by posting messages containing javascript: links or malformed URLs that break quoting, leading to JavaScript execution when other users interact with the links.

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.

Jivejdon contains a reflected cross-site scripting (XSS) vulnerability in the application/query/taggedThreadList.jsp page. This flaw allows unauthenticated attackers to inject malicious scripts via unencoded tagID and count parameters. The vulnerability is triggered when the 'start' parameter exceeds zero, enabling execution of arbitrary JavaScript in the victim's browser. The issue affects versions from commit 5489372d through commit ee67a65e. The CVSS 4.0 base score is 5.3, indicating medium severity.

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.

Jivejdon contains a missing authorization vulnerability in the UpdateThreadToForumAction component that allows authenticated users to move threads they do not own. By sending crafted threadId and forumId parameters to the /message/threadToForum/save endpoint, an attacker can relocate any reply-less thread to an arbitrary forum. This vulnerability affects versions of Jivejdon from commit d58a36b0 through commit ee67a65e. The issue has a medium severity with a CVSS 4.0 score of 5.3.

Jivejdon versions up to 5.0 contain an SQL injection vulnerability in the AccountDaoSql.getAccountByNameLike() function. Authenticated users with administrator privileges can exploit this flaw by injecting malicious SQL through the username parameter on the /admin/user/userListAction endpoint. This allows them to read sensitive database contents, including password hashes of other accounts. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.