SQL Injection Vulnerability in Jivejdon Product by Banq
CVE-2025-71428

6.9MEDIUM

Key Information:

Vendor

Banq

Status
Jivejdon
Vendor
CVE Published:
8 October 2026

What is CVE-2025-71428?

Jivejdon versions up to 5.0 are susceptible to a SQL injection flaw that allows authenticated administrators to manipulate SQL queries through the username parameter in the AccountDaoSql.getAccountByNameLike() method. This vulnerability enables attackers with administrator privileges to exploit the /admin/user/userListAction endpoint, potentially exposing sensitive database content, including password hashes for other user accounts. Prompt action is advised to mitigate the risks associated with this security issue.

Affected Version(s)

jivejdon 0 <= 5.0

References

https://github.com/banq/jivejdon/issues/28
issue-tracking
https://github.com/banq/jivejdon
product
https://github.com/banq/jivejdon/issues/24
issue-tracking

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

intSheep
Ikram-4
.