Jivejdon EUVD-2026-95305

Exploitation requires an authenticated forum account (PR:L) capable of posting message bodies, and succeeds specifically because messageListBody.jsp renders those bodies with filter="false" and RenderingFilterManagerImp.java applies non-escaping default filters - i.e. the stored message body is emitted without HTML/script escaping. The payload only fires when another user passively views the affected thread (UI:P / UI:R), so there is no zero-click or unauthenticated path. Limiting factors: attacker needs valid credentials/posting rights, a victim must load the malicious thread, and impact is confined to the browser context of forum users (session/content level), not the server.

This is a medium-severity stored XSS (CWE-79) with a provided CVSS 4.0 score of 5.1, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N) indicates network-reachable but authenticated (PR:L) exploitation that requires passive victim interaction (UI:P) - a victim must view the malicious thread - and yields only low confidentiality and integrity impact with no availability impact, which is typical for reflected session-/content-level script execution rather than full account or server takeover. No EPSS score, KEV listing, or public POC was provided in the input: exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between a high CVSS and low real-world risk here because the CVSS itself is medium; the dominant risk-limiting factors are the authentication requirement and the niche deployment footprint of Jivejdon. The chief missing signals are EPSS probability and any exploitation telemetry - absence of these is not evidence of safety, but combined with the obscure product this reads as a low-priority issue for most organizations unless they specifically run Jivejdon. One caveat to verify: the technical details (filter="false" in messageListBody.jsp and non-escaping default filters in RenderingFilterManagerImp.java) are sourced from the VulnCheck advisory and the linked source lines, not from an independent vendor patch advisory.

An attacker registers or uses an existing low-privilege forum account on a Jivejdon 5.0 instance and posts a forum message whose body contains a JavaScript payload. Because messageListBody.jsp renders the body with filter="false" and non-escaping default filters, the script is stored and later executes in the browser of every authenticated user who opens that thread, enabling session theft or actions-on-behalf. No public exploit code was identified, but the payload is a trivial unsanitized HTML/script injection.