EUVD-2026-95352
GHSA-8r2f-hc5q-4c95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft link with XSS payload in to/tag params
-
DeliveryDeliver crafted link to authenticated user
-
ExploitVictim opens link, payload reflected into inline JS
-
ExecutionBreak out of string literal, execute script in session
-
ImpactAct as victim / exfiltrate session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim who is an authenticated Jivejdon user to click an attacker-crafted URL targeting application/message/postThread.jsp with injected content in the 'to' or 'tag' request parameters; the payload specifically relies on the parameter values being echoed, unencoded, into an inline JavaScript string literal so the attacker can break out of the string and inject script. Limiting factors: this is reflected (non-persistent) XSS, so it cannot self-propagate and depends entirely on social engineering to get the victim to follow the malicious link; the attacker needs no account, but the target must have an active authenticated session for the attack to yield meaningful session access. No special server configuration is named as a prerequisite - the flaw is in default handling of these parameters in the affected JSP. |
| Impact | This is a reflected cross-site scripting flaw (CWE-79) in Jivejdon, scored 5.3 (Medium) via the supplied CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. The vector shows network reach (AV:N) and low attack complexity (AC:L) with no attacker privileges (PR:N), but it critically requires passive user interaction (UI:P) - the victim must open an attacker-crafted link - which is the dominant limiting factor and consistent with reflected (non-persistent) XSS. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; these signals do not conflict, they are simply absent. Impact is bounded to Low confidentiality/integrity on both the vulnerable and a subsequent system (VC:L/VI:L/SC:L/SI:L) with no availability impact, reflecting session-scoped script execution rather than full account or server compromise. Net: this is a real but moderate, interaction-gated issue affecting a niche open-source forum project, not a drop-everything priority - raw CVSS 'Medium' overstates urgency once the obscure deployment footprint and mandatory social-engineering step are weighed. |
| Exploit ScenarioDerived | An attacker crafts a link to application/message/postThread.jsp with malicious values in the 'to' or 'tag' parameters that break out of an unencoded inline JavaScript string literal, then delivers it to an authenticated Jivejdon user (e.g., via email or forum message). When the victim clicks, the injected script executes in their session, letting the attacker perform actions as that user or steal session context. No public exploit code is identified at time of analysis, but the reflection point and vulnerable line range are documented in the referenced source. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Reflected cross-site scripting in Jivejdon through 5.0 lets an attacker execute arbitrary JavaScript in an authenticated user's session by crafting a URL to application/message/postThread.jsp with malicious values in the 'to' or 'tag' parameters; the payload works by escaping an unencoded inline JavaScript string literal where those values are echoed back. The attacker does not need an account (PR:N per both the supplied CVSS 4.0 vector and the corroborating CVSS 3.1 assessment), but the attack requires the victim to be a logged-in Jivejdon user who clicks the crafted link (UI:P/UI:R), and because the flaw is reflected rather than persistent it cannot self-propagate and depends entirely on social engineering. Both vectors rate it 5.3 Medium with scope change in the 3.1 view, and there is no public exploit code or CISA KEV entry identified at time of analysis, so the immediate risk is targeted phishing-style session abuse rather than mass exploitation.
RemediationAI
No vendor-released patch was identified at time of analysis, so operators should treat upstream issue https://github.com/banq/jivejdon/issues/28, the code reference https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72, and the VulnCheck advisory as the tracking sources for a fix, and apply the corrected code or a patched commit as soon as it is published. In the interim, the definitive code-level fix is to stop writing the 'to' and 'tag' parameters directly into the inline JavaScript string literal in postThread.jsp and instead render them with JavaScript-string context encoding (escaping quotes, backslashes, line terminators and the </script> sequence) or, preferably, emit them through a JSON serializer and read them as parsed values; a strict Content-Security-Policy that disallows inline script will break this specific exploit path, though it may break other legacy inline JavaScript in the application until refactored. Additional compensating controls with lower fidelity include setting the session cookie to HttpOnly to blunt cookie theft (it does not stop in-session actions or token relay), shortening session lifetimes and requiring re-authentication for sensitive forum actions, and filtering or normalizing requests to postThread.jsp that carry quotes, angle brackets, or newline characters in the 'to' and 'tag' parameters at a reverse proxy or WAF (bypassable and prone to false positives on legitimate tag names). Because exploitation is reflected only and requires a logged-in victim to click a crafted link, user awareness around unsolicited forum links is a useful secondary measure but should not replace fixing the output encoding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a JavaServer Pages view in the Jivejdon forum/bulletin-board application (vendor namespace 'banq', tracked as CPE cpe:2.3:a:banq:jivejdon:*:*:*:*:*:*:*:* covering all versions through 5.0). The vulnerable code lives in application/message/postThread.jsp, specifically the region referenced at lines 54-72 of commit ee67a65e65228644a71c8317d7e34deea50f95ef, where the request parameters 'to' and 'tag' are written directly into an inline JavaScript string literal without context-appropriate encoding. This falls under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting); the root cause is the classic mismatch between an HTML/JavaScript output context and the encoding applied, so a value such as a quote or bracket sequence closes the string and allows arbitrary script to be appended. Because the sink is a JavaScript string rather than raw HTML, standard HTML entity encoding alone can be insufficient and the fix must apply JavaScript-string-safe escaping (or safer still, serialize the values via JSON encoding) at the point of rendering. The attacker controls the full URL and thus both parameter values, but the reflected nature of the flaw means the script executes only in the browser session that follows the malicious link.
Know when Jivejdon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Reflected XSS reachable over the network with no attacker auth (PR:N) but requiring the victim to click a link (UI:R); script runs in the browser context so S:C with low C/I and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted throu
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimi
SQL injection in Jivejdon through 5.0 allows an authenticated user with the Admin role to read arbitrary database conten
Authentication bypass in Jivejdon through 5.0 allows remote attackers to log in as any user whose account was created th
Authenticated users can delete other users' subscriptions in Jivejdon through 5.0 by sending a delete action with a vict
Reflected cross-site scripting in Jivejdon from commit 5489372d through ee67a65e allows unauthenticated remote attackers
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) let
Cross-site request forgery in Jivejdon through 5.0 allows unauthenticated attackers to trick authenticated users into de
Stored cross-site scripting in Jivejdon through 5.0 allows an authenticated user to embed script inside a private short
Stored cross-site scripting in Jivejdon through 5.0 lets an authenticated, upload-capable user store an attachment whose
Stored cross-site scripting in Jivejdon through 5.0 allows any authenticated forum user to inject JavaScript into a thre
Stored cross-site scripting in the JiveJdon forum platform (banq/jivejdon) from commit 595d8d22 through commit ee67a65e
Exploit-DB