Jivejdon
Monthly
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.
Cross-site request forgery in Jivejdon through 5.0 allows unauthenticated attackers to trick authenticated users into deleting private messages and subscriptions or renaming threads by luring them to crafted GET requests against /account/protected/delAll, /account/protected/sub/delSub, and /message/updateAction. These endpoints lack anti-CSRF tokens and accept GET requests, so a simple link, image, or iframe can trigger state changes on behalf of the victim; exploitation requires the victim to already hold a valid session and to load attacker-controlled content. The impact is limited to integrity (no data disclosure or denial of service), no public exploit code or active exploitation has been identified, and this is a genuine-but-low-priority issue per independent assessment.
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimited SMS messages to arbitrary phone numbers, leading to harassment and depletion of the operator's Tencent Cloud SMS balance. Affected commits range from e0306088 through ee67a65e, and exploitation requires the instance to have Tencent Cloud SMS integration configured and funded; attackers must first load newAccount.jsp to set session attributes before repeatedly calling the endpoint. No public exploit code or active exploitation has been identified, and this is assessed as a medium-severity resource and financial abuse issue rather than a high-priority emergency.
Authentication bypass in Jivejdon through 5.0 allows remote attackers to log in as any user whose account was created through the Sina Weibo OAuth flow, because OAuthAccountServiceImp.transferSina() and the SinaUserCallBackAction callback assign those accounts a password made up of the first four digits of the user's public Weibo ID. Since the Weibo ID is publicly visible, an unauthenticated attacker who knows or enumerates a victim's ID can submit that four-digit value through the ordinary form login and then read or post content as the victim (limited confidentiality and integrity impact). No public exploit code was identified and the CVE is not listed in CISA KEV, so exploitation is currently a design-flaw/credential-prediction risk rather than a confirmed actively exploited campaign; only accounts provisioned via the Weibo integration are exposed, not accounts created by other means.
Stored cross-site scripting in Jivejdon through 5.0 lets an authenticated, upload-capable user store an attachment whose client-supplied Content-Type is text/html; because UploadShowAction serves that attachment inline on the application's own origin, any logged-in user who opens the shared link executes the attacker's JavaScript in the Jivejdon origin (CVSS 4.0 base 5.1, CWE-79). Exploitation requires a low-privileged account permitted to upload attachments (CVSS PR:L) plus victim interaction with the crafted link (UI:P), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, so this is a real but bounded medium-severity issue rather than an urgent one. It is not in CISA KEV and no public exploit code was identified at time of analysis; an upstream GitHub issue tracks the report.
Stored cross-site scripting in Jivejdon through 5.0 allows an authenticated user to embed script inside a private short message that then executes in the recipient's browser when the message is opened. The flaw is reachable over the network but gated by two prerequisites: the attacker must hold a valid account able to send private messages, and the victim must actively open the malicious message, so real-world abuse is limited to targeted attacks against a chosen user rather than unattended, broad compromise. It carries a vendor CVSS 4.0 score of 5.1 (our independent 3.1 assessment aligns at AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in Jivejdon through 5.0 allows any authenticated forum user to inject JavaScript into a thread by posting an unsanitized message body, which then executes in the browser of every other user who opens that thread. The flaw arises because messageListBody.jsp renders stored message bodies with filter="false" and RenderingFilterManagerImp.java applies non-escaping default filters, so attacker-supplied HTML/script is emitted verbatim; exploitation requires a valid posting account (PR:L) plus a victim passively viewing the thread (UI:R), and impact stays within the browser/session context of forum users rather than the server. The provided CVSS 4.0 score is 5.1 (medium) and the independent assessment (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is consistent with that rating; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Stored cross-site scripting in the JiveJdon forum platform (banq/jivejdon) from commit 595d8d22 through commit ee67a65e lets an authenticated user who can post messages inject javascript: URLs or quote-breaking link markup that the default-enabled TextStyle filter writes unvalidated into anchor href attributes, so JavaScript executes when another user clicks or hovers a rendered link. Exploitation requires a valid posting account (PR:L) and victim interaction (UI:P), and the default TextStyle filter must be active on a vulnerable commit; this is a moderate, not a top-priority, issue. No public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), and no vendor-released patch version is identified in the available data.
Reflected cross-site scripting in Jivejdon through 5.0 lets an attacker execute arbitrary JavaScript in an authenticated user's session by crafting a URL to application/message/postThread.jsp with malicious values in the 'to' or 'tag' parameters; the payload works by escaping an unencoded inline JavaScript string literal where those values are echoed back. The attacker does not need an account (PR:N per both the supplied CVSS 4.0 vector and the corroborating CVSS 3.1 assessment), but the attack requires the victim to be a logged-in Jivejdon user who clicks the crafted link (UI:P/UI:R), and because the flaw is reflected rather than persistent it cannot self-propagate and depends entirely on social engineering. Both vectors rate it 5.3 Medium with scope change in the 3.1 view, and there is no public exploit code or CISA KEV entry identified at time of analysis, so the immediate risk is targeted phishing-style session abuse rather than mass exploitation.
Reflected cross-site scripting in Jivejdon from commit 5489372d through ee67a65e allows unauthenticated remote attackers to execute JavaScript in a victim's browser by crafting a link to application/query/taggedThreadList.jsp with a script-closing payload in the tagID or count parameter when the start parameter is greater than zero. Exploitation requires the victim to open the crafted link (UI:P), and the impact is limited to the victim's browser context. No CISA KEV active exploitation is noted, no public exploit identified at time of analysis, and the CVSS 4.0 base score is 5.3.
Authenticated users can delete other users' subscriptions in Jivejdon through 5.0 by sending a delete action with a victim's subscriptionId to /account/protected/sub/subSaveAction, because SubscriptionServiceImp.deleteSubscription does not verify ownership of the supplied ID. This CWE-639 authorization bypass/IDOR requires a valid low-privileged account and knowledge or enumeration of numeric subscription IDs; it has integrity-only impact on subscription records, with no confidentiality disclosure or service outage, and no public exploit identified at time of analysis. The CVE record lists CVSS 5.3 (CVSS 4.0 vector with PR:L, UI:N, and I:L), and the independent assessment is consistent with a medium-severity, authenticated remote IDOR whose real-world risk is modest.
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) lets any authenticated user relocate another user's forum thread into an arbitrary forum by submitting crafted threadId and forumId values to /message/threadToForum/save. The flaw stems from an absent ownership or role check in the action handler (CWE-862), and it is constrained in practice because only threads with no replies can be moved and the attacker must already hold a valid account, so impact is limited to integrity (thread relocation) with no confidentiality or availability loss and a CVSS 5.3 / CVSS:3.1 5.3 rating. There is no public exploit identified at time of analysis and no confirmed active exploitation, so this is a modest-severity issue rather than an urgent one.
SQL injection in Jivejdon through 5.0 allows an authenticated user with the Admin role to read arbitrary database contents, including other accounts' password hashes, by submitting a crafted username to the /admin/user/userListAction endpoint (AccountDaoSql.getAccountByNameLike()). The CVSS 4.0 vector (PR:H) confirms this is not reachable by anonymous or low-privilege users, so the practical risk is insider abuse or post-compromise credential harvesting rather than broad exploitation. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed impact is confidentiality-only (database read; no integrity or availability effect).
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.
Cross-site request forgery in Jivejdon through 5.0 allows unauthenticated attackers to trick authenticated users into deleting private messages and subscriptions or renaming threads by luring them to crafted GET requests against /account/protected/delAll, /account/protected/sub/delSub, and /message/updateAction. These endpoints lack anti-CSRF tokens and accept GET requests, so a simple link, image, or iframe can trigger state changes on behalf of the victim; exploitation requires the victim to already hold a valid session and to load attacker-controlled content. The impact is limited to integrity (no data disclosure or denial of service), no public exploit code or active exploitation has been identified, and this is a genuine-but-low-priority issue per independent assessment.
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimited SMS messages to arbitrary phone numbers, leading to harassment and depletion of the operator's Tencent Cloud SMS balance. Affected commits range from e0306088 through ee67a65e, and exploitation requires the instance to have Tencent Cloud SMS integration configured and funded; attackers must first load newAccount.jsp to set session attributes before repeatedly calling the endpoint. No public exploit code or active exploitation has been identified, and this is assessed as a medium-severity resource and financial abuse issue rather than a high-priority emergency.
Authentication bypass in Jivejdon through 5.0 allows remote attackers to log in as any user whose account was created through the Sina Weibo OAuth flow, because OAuthAccountServiceImp.transferSina() and the SinaUserCallBackAction callback assign those accounts a password made up of the first four digits of the user's public Weibo ID. Since the Weibo ID is publicly visible, an unauthenticated attacker who knows or enumerates a victim's ID can submit that four-digit value through the ordinary form login and then read or post content as the victim (limited confidentiality and integrity impact). No public exploit code was identified and the CVE is not listed in CISA KEV, so exploitation is currently a design-flaw/credential-prediction risk rather than a confirmed actively exploited campaign; only accounts provisioned via the Weibo integration are exposed, not accounts created by other means.
Stored cross-site scripting in Jivejdon through 5.0 lets an authenticated, upload-capable user store an attachment whose client-supplied Content-Type is text/html; because UploadShowAction serves that attachment inline on the application's own origin, any logged-in user who opens the shared link executes the attacker's JavaScript in the Jivejdon origin (CVSS 4.0 base 5.1, CWE-79). Exploitation requires a low-privileged account permitted to upload attachments (CVSS PR:L) plus victim interaction with the crafted link (UI:P), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, so this is a real but bounded medium-severity issue rather than an urgent one. It is not in CISA KEV and no public exploit code was identified at time of analysis; an upstream GitHub issue tracks the report.
Stored cross-site scripting in Jivejdon through 5.0 allows an authenticated user to embed script inside a private short message that then executes in the recipient's browser when the message is opened. The flaw is reachable over the network but gated by two prerequisites: the attacker must hold a valid account able to send private messages, and the victim must actively open the malicious message, so real-world abuse is limited to targeted attacks against a chosen user rather than unattended, broad compromise. It carries a vendor CVSS 4.0 score of 5.1 (our independent 3.1 assessment aligns at AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in Jivejdon through 5.0 allows any authenticated forum user to inject JavaScript into a thread by posting an unsanitized message body, which then executes in the browser of every other user who opens that thread. The flaw arises because messageListBody.jsp renders stored message bodies with filter="false" and RenderingFilterManagerImp.java applies non-escaping default filters, so attacker-supplied HTML/script is emitted verbatim; exploitation requires a valid posting account (PR:L) plus a victim passively viewing the thread (UI:R), and impact stays within the browser/session context of forum users rather than the server. The provided CVSS 4.0 score is 5.1 (medium) and the independent assessment (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is consistent with that rating; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Stored cross-site scripting in the JiveJdon forum platform (banq/jivejdon) from commit 595d8d22 through commit ee67a65e lets an authenticated user who can post messages inject javascript: URLs or quote-breaking link markup that the default-enabled TextStyle filter writes unvalidated into anchor href attributes, so JavaScript executes when another user clicks or hovers a rendered link. Exploitation requires a valid posting account (PR:L) and victim interaction (UI:P), and the default TextStyle filter must be active on a vulnerable commit; this is a moderate, not a top-priority, issue. No public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), and no vendor-released patch version is identified in the available data.
Reflected cross-site scripting in Jivejdon through 5.0 lets an attacker execute arbitrary JavaScript in an authenticated user's session by crafting a URL to application/message/postThread.jsp with malicious values in the 'to' or 'tag' parameters; the payload works by escaping an unencoded inline JavaScript string literal where those values are echoed back. The attacker does not need an account (PR:N per both the supplied CVSS 4.0 vector and the corroborating CVSS 3.1 assessment), but the attack requires the victim to be a logged-in Jivejdon user who clicks the crafted link (UI:P/UI:R), and because the flaw is reflected rather than persistent it cannot self-propagate and depends entirely on social engineering. Both vectors rate it 5.3 Medium with scope change in the 3.1 view, and there is no public exploit code or CISA KEV entry identified at time of analysis, so the immediate risk is targeted phishing-style session abuse rather than mass exploitation.
Reflected cross-site scripting in Jivejdon from commit 5489372d through ee67a65e allows unauthenticated remote attackers to execute JavaScript in a victim's browser by crafting a link to application/query/taggedThreadList.jsp with a script-closing payload in the tagID or count parameter when the start parameter is greater than zero. Exploitation requires the victim to open the crafted link (UI:P), and the impact is limited to the victim's browser context. No CISA KEV active exploitation is noted, no public exploit identified at time of analysis, and the CVSS 4.0 base score is 5.3.
Authenticated users can delete other users' subscriptions in Jivejdon through 5.0 by sending a delete action with a victim's subscriptionId to /account/protected/sub/subSaveAction, because SubscriptionServiceImp.deleteSubscription does not verify ownership of the supplied ID. This CWE-639 authorization bypass/IDOR requires a valid low-privileged account and knowledge or enumeration of numeric subscription IDs; it has integrity-only impact on subscription records, with no confidentiality disclosure or service outage, and no public exploit identified at time of analysis. The CVE record lists CVSS 5.3 (CVSS 4.0 vector with PR:L, UI:N, and I:L), and the independent assessment is consistent with a medium-severity, authenticated remote IDOR whose real-world risk is modest.
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) lets any authenticated user relocate another user's forum thread into an arbitrary forum by submitting crafted threadId and forumId values to /message/threadToForum/save. The flaw stems from an absent ownership or role check in the action handler (CWE-862), and it is constrained in practice because only threads with no replies can be moved and the attacker must already hold a valid account, so impact is limited to integrity (thread relocation) with no confidentiality or availability loss and a CVSS 5.3 / CVSS:3.1 5.3 rating. There is no public exploit identified at time of analysis and no confirmed active exploitation, so this is a modest-severity issue rather than an urgent one.
SQL injection in Jivejdon through 5.0 allows an authenticated user with the Admin role to read arbitrary database contents, including other accounts' password hashes, by submitting a crafted username to the /admin/user/userListAction endpoint (AccountDaoSql.getAccountByNameLike()). The CVSS 4.0 vector (PR:H) confirms this is not reachable by anonymous or low-privilege users, so the practical risk is insider abuse or post-compromise credential harvesting rather than broad exploitation. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed impact is confidentiality-only (database read; no integrity or availability effect).