CVE-2026-107797

6.1 Moyenne

Publiée le 09/10/2026 à 00:17 · Modifiée le 09/10/2026 à 18:45 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.

Traduire en français

Produits concernés

banq jivejdon

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.1 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/banq/jivejdon
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72
https://github.com/banq/jivejdon/issues/28
https://www.vulncheck.com/advisories/jivejdon-through-5.0-reflected-xss-via-postthread-jsp-to-and-tag-parameters

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories