CVE-2026-107831

The software Jivejdon (through version 5.0 ) is vulnerable to a cross-site request forgery (CSRF) vulnerability. The root cause is the presence of GET endpoints that lack anti-CSRF tokens, allowing remote attackers to perform state-changing actions. By luring authenticated users into clicking cra...

CVE-2026-107831 Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107800

Jivejdon versions through 5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is that receiveshortmessage.jsp renders unfiltered message bodies, while the ToolsUtil.convertURL() function fails to strip out malicious scripts. This allows authenticated attackers to inject...

CVE-2026-107800 Jivejdon through 5.0 Stored XSS via Private Short Messages

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

CVE-2026-107797

The software Jivejdon (through version 5.0 ) is vulnerable to a reflected cross-site scripting (XSS) flaw in the application/message/postThread.jsp component. The root cause is the failure to properly encode the to and tag parameters, which allows an attacker to break out of unencoded inline Java...

CVE-2026-107797 Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...