Login Request a demo
Medium severity · published Oct 8, 2026
CVE-2026-107830
Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
jivejdon · banq
e03060885db5726e46d30f55ac67920318d0d1fc through ee67a65e65228644a71c8317d7e34deea50f95ef · source: vendor
Affected product
JI
jivejdon
banq
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107830
issue-tracking
https://github.com/banq/jivejdon/issues/28
product
https://github.com/banq/jivejdon
technical-description
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79
technical-description
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29
third-party-advisory
https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-rate-limiting-via-account-smsvraction-sms-endpoint
More from jivejdon
6.5
CVE-2026-107828
Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
6.1
CVE-2026-107797
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
6.1
CVE-2026-107796
Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
5.9
CVE-2026-107829
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
5.4
CVE-2026-107801
Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type