CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary...

CVE-2026-107830

The Jivejdon software (from commit e0306088 through ee67a65e ) is vulnerable to a missing rate limiting issue on the unauthenticated /account/smsVRAction endpoint. This endpoint is handled by SmsQQAction , and the lack of restrictions allows for unlimited SMS sending. An attacker can first load n...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages,...

EduSoho 最新版两处泄露accessKey和secretKey

简要描述： 可在官网重新绑定，发送云短信，下载安装应用。 详细说明： 出现问题的地方在安装文件/start-install.php false, ; $twig-addGlobal'edushoversion', \Topxia\System::VERSION; $step =intvalempty$GET'step' ? 0 : $GET'step'; $functionName = 'installstep' . $step; $functionName; use Topxia\Service\Common\ServiceKernel; use...