CVE-2026-107796 Details
Description
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing payload in tagID or count, triggered when start exceeds zero, to execute JavaScript in victims' browsers.
A reflected cross-site scripting vulnerability has been identified in Jivejdon, specifically in the 'application/query/taggedThreadList.jsp' file, within the commit range from '5489372d' to 'ee67a65e'. This vulnerability allows unauthenticated attackers to inject scripts via the unencoded 'tagID' and 'count' parameters. The issue is triggered when the 'start' parameter exceeds zero, executing JavaScript in the browsers of the victims.
Users are advised to update to the latest version of Jivejdon, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/banq/jivejdon | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/query/taggedThreadList.jsp#L25-L41 | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/issues/28 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-reflected-xss-via-taggedthreadlist-jsp-tagid-and-count-parameters | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| banq Jivejdon | >= 5489372d3c6ddee8c275da414c2c59655d8b7675, <= ee67a65e65228644a71c8317d7e34deea50f95ef |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |