Jivejdon CVE-2026-107800

Exploitation requires (1) an authenticated Jivejdon account able to send private short messages (PR:L), and (2) the targeted recipient opening the malicious short message in their browser (UI:P), at which point receiveshortmessage.jsp renders the unfiltered message body - ToolsUtil.convertURL() does not sanitize script content. The specific feature required is the private short-message (PM) functionality; this is not exploitable against anonymous/unauthenticated users and does not fire automatically without the victim viewing the message. These factors (prior authentication plus victim interaction) meaningfully limit real-world exploitation to targeted abuse against a selected user rather than broad, unattended compromise.

This is a medium-severity stored XSS (CWE-79) with a vendor-supplied CVSS 4.0 score of 5.1, and the signals are internally consistent: the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N shows a network-reachable but privilege- and interaction-gated flaw, not a drive-by. No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit code is referenced - so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The practical risk is bounded: an attacker must already hold a valid authenticated account (PR:L) to send a short message, and the payload only fires when the specific recipient opens it (UI:P), making this a targeted stored-XSS against a chosen victim rather than a wormable or mass-exploitation condition. The limited VC/VI (Low) and lack of availability impact mean session/credential theft or UI manipulation in the recipient's browser is the realistic ceiling, not system compromise. Overall this is a legitimate but low-priority issue for most defenders - real but constrained, and heavily dependent on the product's small deployment footprint.

An authenticated forum user crafts a private short message whose body contains a script payload and sends it to a chosen recipient. Because receiveshortmessage.jsp renders the message body unfiltered and ToolsUtil.convertURL() passes it through unchanged, the script executes in the recipient's browser when they open the message, enabling session-cookie theft or actions as the victim. No public exploit code is identified at time of analysis, and the attack requires the recipient to actually open the message (UI:P).