Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107797Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

Medium 6.1

In plain English

A medium-severity cross-site scripting in jivejdon from banq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.

Affected products (as reported)

Vendor	Product	Versions
banq	jivejdon	0 – through 5.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Issue #28 issue-tracking
https://github.com/banq/jivejdon product
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72 technical-description
VulnCheck Advisory: Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters third-party-advisory