CVE-2026-107800

Received Received - Intake

Stored XSS in Jivejdon Private Messages via Unfiltered Message Bodies

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107800

Affected Vendors & Products

Vendor	Product	Version / Range
banq	jivejdon	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Jivejdon through version 5.0 has a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can inject malicious scripts into private short messages. The issue occurs because the receiveshortmessage.jsp page does not filter message content properly. When ToolsUtil.convertURL() processes the message, it passes the script unchanged, allowing execution in the recipient's browser when the message is opened.

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in your browser when you view a malicious private message. This could lead to session hijacking, theft of sensitive data, or unauthorized actions on your behalf. Attackers may also deface content or redirect you to phishing sites.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and loss of trust due to insufficient input validation and output encoding.

Mitigation Strategies

Upgrade Jivejdon to a version that filters message bodies in receiveshortmessage.jsp. If immediate upgrade is not possible, restrict access to the vulnerable endpoint or disable private short messages until patched.

Hi! I’m here to help you understand CVE-2026-107800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70