{"id":"CVE-2026-107799","title":"Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies","summary":"Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter=\"f…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-10-08","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:17:17.720","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107799","references":[{"url":"https://github.com/banq/jivejdon","label":"disclosure@vulncheck.com"},{"url":"https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/thread/messageListBody.jsp#L136-L138","label":"disclosure@vulncheck.com"},{"url":"https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/output/RenderingFilterManagerImp.java#L48-L49","label":"disclosure@vulncheck.com"},{"url":"https://github.com/banq/jivejdon/issues/28","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/jivejdon-through-5.0-stored-xss-via-messagelistbody-jsp-forum-message-rendering","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00215,"epssPercentile":0.11823,"ingestedAt":"2026-10-08T23:16:47.391Z","vendor":"banq","product":"jivejdon","affected":["jivejdon <= 5.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T16:11:57.250397Z"},"slug":"CVE-2026-107799","body":"## Overview\n\nJivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter=\"false\" and non-escaping default filters, executing script in the browser of every user viewing the thread.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}