EUVD-2026-95304
GHSA-x3wr-65j4-jv4v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with posting account
-
DeliverySubmit message with javascript: link
-
ExploitTextStyle filter writes unvalidated href
-
ExecutionVictim clicks or hovers link
-
ImpactExecute JavaScript in victim session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with permission to post messages, and the target instance must be running the default-enabled TextStyle rendering filter (the default state per the description) on a vulnerable commit between 595d8d22 and ee67a65e. The attacker injects a javascript: URL or a quote-breaking URL into a markdown link that the filter places into an anchor href without validation. Exploitation is limited by the need for victim interaction - another user must click or hover the rendered link (UI:P) - and by the authentication requirement (PR:L), so it cannot be triggered pre-auth or without a victim action. |
| Impact | This is a moderate, not a top-priority, issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N, score 5.1) describes a network-reachable but authenticated (PR:L) stored XSS that requires passive victim interaction (UI:P - clicking or hovering a rendered link) and yields only low confidentiality and integrity impact with no availability impact, which aligns well with the CWE-79 classification and the description. No EPSS score, KEV listing, or POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the two preconditions (an authenticated posting account plus a victim action) keep real-world risk contained to targeted or opportunistic forum-poisoning rather than automated mass exploitation. The signals are internally consistent - there is no conflict between the CVSS vector and the description. The main residual uncertainty is footprint: jivejdon is an obscure open-source Java forum project, so even though the flaw is genuine and default-enabled, few production environments are likely exposed. Treat as a standard-severity bug to patch during normal maintenance. |
| Exploit ScenarioDerived | An attacker with a normal authenticated forum account posts a message containing a crafted markdown link whose URL is a javascript: scheme or a quote-breaking string. The default-enabled TextStyle filter inserts the unvalidated URL directly into an anchor href, so when another user clicks or hovers the rendered link, attacker-controlled JavaScript executes in that victim's browser session. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stored cross-site scripting in the JiveJdon forum platform (banq/jivejdon) from commit 595d8d22 through commit ee67a65e lets an authenticated user who can post messages inject javascript: URLs or quote-breaking link markup that the default-enabled TextStyle filter writes unvalidated into anchor href attributes, so JavaScript executes when another user clicks or hovers a rendered link. Exploitation requires a valid posting account (PR:L) and victim interaction (UI:P), and the default TextStyle filter must be active on a vulnerable commit; this is a moderate, not a top-priority, issue. No public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), and no vendor-released patch version is identified in the available data.
RemediationAI
No vendor-released patch identified at time of analysis - the references point to a GitHub issue (https://github.com/banq/jivejdon/issues/28) and the vulnerable source blob rather than to a tagged fixed release, so operators should track that issue and the project repository (https://github.com/banq/jivejdon) for an upstream fix commit and then redeploy from a revision after ee67a65e. Until a fixed revision is applied, the most direct control is to disable or replace the TextStyle message output filter (removing it from the message output filter chain), which stops the vulnerable href interpolation entirely at the cost of losing markdown-style link and text styling in rendered posts. A second option is to patch the renderer locally to allowlist URI schemes (permit only http and https) and to HTML-attribute-encode link URLs before they reach the href attribute, which preserves link rendering but requires maintaining a fork. Where the rendering path cannot be changed, tighten the attack surface by restricting message-posting privileges to trusted users only, since the flaw requires a posting account, and deploy a Content-Security-Policy that disallows inline and javascript: script execution to blunt payload impact - noting CSP reduces but does not eliminate the risk because victims must still click or hover the poisoned link. Consult https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-stored-xss-via-markdown-links-in-textstyle-rendering-filter for the vendor-adjacent advisory detail and any updated fix guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JiveJdon is an open-source Java forum/discussion application whose message rendering pipeline passes user-submitted text through a TextStyle output/rendering filter (com.jdon.jivejdon.domain.model.message.output.html.TextStyle, lines 242-243 of the referenced revision). That filter converts markdown-style link syntax into HTML anchors but does not validate or scheme-restrict the URL before interpolating it into the href attribute, which is a classic CWE-79 improper neutralization of user-controlled input in generated HTML. Two abuse paths follow from the missing validation: a javascript: URI survives into href so a victim click executes script in the site origin, and crafted quote characters can break out of the attribute context to inject arbitrary markup or event handlers that fire on hover. Because the payload is persisted as a message and re-rendered to every viewer, this is stored rather than reflected XSS. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that the impact is bounded: low confidentiality and integrity effect, no availability impact, but a scope change because injected script runs in the context of other users' sessions.
Know when Jivejdon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Authenticated poster so PR:L, victim must click/hover so UI:R, stored XSS executing in another user's browser crosses a trust boundary so S:C with low C/I and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted throu
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimi
SQL injection in Jivejdon through 5.0 allows an authenticated user with the Admin role to read arbitrary database conten
Authentication bypass in Jivejdon through 5.0 allows remote attackers to log in as any user whose account was created th
Authenticated users can delete other users' subscriptions in Jivejdon through 5.0 by sending a delete action with a vict
Reflected cross-site scripting in Jivejdon from commit 5489372d through ee67a65e allows unauthenticated remote attackers
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) let
Reflected cross-site scripting in Jivejdon through 5.0 lets an attacker execute arbitrary JavaScript in an authenticated
Cross-site request forgery in Jivejdon through 5.0 allows unauthenticated attackers to trick authenticated users into de
Stored cross-site scripting in Jivejdon through 5.0 allows an authenticated user to embed script inside a private short
Stored cross-site scripting in Jivejdon through 5.0 lets an authenticated, upload-capable user store an attachment whose
Stored cross-site scripting in Jivejdon through 5.0 allows any authenticated forum user to inject JavaScript into a thre
Exploit-DB