Reflected Cross-Site Scripting in Jivejdon Application
CVE-2026-107796

5.3MEDIUM

Key Information:

Vendor: Banq
Status: Jivejdon
Vendor: CVE Published:; 8 October 2026

What is CVE-2026-107796?

Jivejdon features a reflected cross-site scripting vulnerability located in the application/query/taggedThreadList.jsp file. This flaw allows unauthenticated attackers to inject malicious scripts via unencoded 'tagID' and 'count' parameters. By crafting malicious URLs with script-closing payloads, attackers can execute arbitrary JavaScript in the browsers of users when the 'start' parameter exceeds zero. This could lead to session hijacking or the manipulation of cookie data.

Affected Version(s)

jivejdon 5489372d3c6ddee8c275da414c2c59655d8b7675

References

https://github.com/banq/jivejdon/issues/28

issue-tracking

https://github.com/banq/jivejdon

product

https://github.com/banq/jivejdon/blob/ee67a65e65228644a71...

technical-description

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 8, 2026
Vulnerability Reserved
Oct 8, 2026

Credit

Ikram-4

CVE-2026-107796 Data

JSON