CVE-2026-107797: Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-09
Weakness: CWE-79

Description

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.

Affected products

banq jivejdon: through 5.0

References

https://github.com/banq/jivejdon
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72
https://github.com/banq/jivejdon/issues/28
https://www.vulncheck.com/advisories/jivejdon-through-5.0-reflected-xss-via-postthread-jsp-to-and-tag-parameters

Get alerted when CVE-2026-107797 or the next vulnerability affects your stack