CVE-2026-107800 Details
Description
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.
A stored cross-site scripting vulnerability has been identified in Jivejdon versions through 5.0. This vulnerability allows authenticated attackers to inject scripts into private short messages, as the 'receiveshortmessage.jsp' file renders message bodies without proper filtering. When the recipient opens the message, the injected script is executed in their browser. The vulnerability arises because the 'ToolsUtil.convertURL()' function passes unaltered message content, enabling the execution of malicious scripts.
Users can update to Jivejdon version 5.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/banq/jivejdon | [email protected] | ProductVendor |
| https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/shortmessage/receiveshortmessage.jsp#L63 | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/form/ShortMessageForm.java#L89-L91 | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/issues/28 | [email protected] | BundleExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/jivejdon-through-5.0-stored-xss-via-private-short-messages | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| banq Jivejdon | <= 5.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |