Jivejdon EUVD-2026-95310

Exploitation requires that the jivejdon instance be deployed with Tencent Cloud SMS integration configured and funded, and that the /account/smsVRAction endpoint (handled by SmsQQAction) be reachable without authentication, which matches the described default behavior. The attacker must first load newAccount.jsp to populate the needed session attributes before the endpoint will send messages. No authentication or user interaction is required (PR:N/UI:N). The practical limiting factors are: the operator must actually have a configured, funded Tencent Cloud SMS account for impact to materialize, and the impact is confined to SMS spam/harassment of third-party numbers and depletion of the SMS balance - there is no code execution, data exposure, or integrity impact.

This is a medium-severity resource/financial abuse issue, not a high-priority emergency. The CVSS 4.0 signals (AV:N/AC:L/AT:N/PR:N/UI:N) correctly indicate remote, unauthenticated, low-complexity reachability, but the only impact is VA:L - degraded availability of the SMS service (balance exhaustion), with no confidentiality (VC:N) or integrity (VI:N) impact, which keeps the score at 6.9. There is NO EPSS score provided, NO CISA KEV listing, and NO public exploit code referenced, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is further bounded by the fact that the affected product, banq/jivejdon, is an obscure open-source Java forum project with negligible production deployment. The practical harm (SMS spam harassment of third parties and draining the operator's Tencent Cloud SMS balance) is real and easy to trigger where the product is deployed with SMS configured, but the tiny install base makes this a low aggregate-priority issue despite the network/unauthenticated vector. Note: the input Tag 'Information Disclosure' conflicts with the actual impact - this is a rate-limiting/resource-consumption flaw with no data disclosure.

A remote, unauthenticated attacker loads newAccount.jsp to seed the required session attributes, then scripts repeated calls to the /account/smsVRAction endpoint, each triggering an outbound SMS to an attacker-chosen phone number. By looping these requests the attacker floods victims with harassing text messages and burns through the operator's prepaid Tencent Cloud SMS balance. No public exploit code is referenced, but the attack is trivially reproducible from the vulnerable endpoint behavior described.