Login Request a demo
Medium severity · published Oct 8, 2026
CVE-2026-107797
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
jivejdon · banq
through 5.0 · source: vendor
Affected product
JI
jivejdon
banq
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107797
issue-tracking
https://github.com/banq/jivejdon/issues/28
product
https://github.com/banq/jivejdon
technical-description
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72
third-party-advisory
https://www.vulncheck.com/advisories/jivejdon-through-5.0-reflected-xss-via-postthread-jsp-to-and-tag-parameters
More from jivejdon
6.5
CVE-2026-107828
Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
6.1
CVE-2026-107796
Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
5.9
CVE-2026-107829
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
5.4
CVE-2026-107801
Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
5.4
CVE-2026-107800
Jivejdon through 5.0 Stored XSS via Private Short Messages