Jivejdon EUVD-2026-95351

Exploitation requires the attacker to craft a request to application/query/taggedThreadList.jsp with a script-closing payload in the tagID or count parameter AND the start parameter set to a value greater than zero, which is the specific condition that triggers the reflection. No authentication is required (PR:N), but successful attack depends on victim user interaction (UI:P) - the target must open the attacker-supplied link - which limits exploitation to social-engineering delivery. Impact is confined to the victim's browser context (reflected, non-persistent XSS), and the realistic risk is further bounded by the product's very narrow deployment footprint.

This is a reflected XSS flaw (CWE-79) carrying a moderate CVSS 4.0 base score of 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - network-reachable, low complexity, unauthenticated (PR:N), but requiring victim interaction (UI:P) with only limited confidentiality/integrity impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation; this is reflected (non-persistent) XSS requiring the attacker to lure a victim into clicking a crafted link, which structurally caps its spread compared to stored XSS or server-side RCE. The signals are internally consistent - a browser-side injection with user-interaction dependency and partial impact aligns with the medium score - and there is no conflict between the CVSS vector and the description. Net: this is a real but low-priority web vulnerability rather than a high-urgency issue, and its practical risk is dominated by the extremely small deployment footprint of the affected product (Jivejdon, an obscure open-source Java/JSP forum) far more than by any of the exploitation signals. EPSS is absent (not an error), so probabilistic exploitation likelihood cannot be quantified from the provided data.

An attacker crafts a URL to taggedThreadList.jsp embedding a script-closing payload in the unencoded tagID or count parameter with start set above zero, then delivers it to a victim via phishing or a malicious link. When the logged-in or anonymous victim opens the link, the forum reflects the payload unencoded and the injected JavaScript executes in their browser session. No public exploit code was identified at time of analysis, though the advisory describes the exact injectable parameters and trigger condition.