{"id":"CVE-2026-107797","summary":"Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters","details":"Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.","modified":"2026-10-11T07:05:41.617769262Z","published":"2026-10-08T21:51:29.704Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107797.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107797.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107797"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/jivejdon-through-5.0-reflected-xss-via-postthread-jsp-to-and-tag-parameters"},{"type":"REPORT","url":"https://github.com/banq/jivejdon/issues/28"},{"type":"PACKAGE","url":"https://github.com/banq/jivejdon"},{"type":"ARTICLE","url":"https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/banq/jivejdon","events":[{"introduced":"0"},{"fixed":"910fafbfa718d0a2be6bb034fa02bcbb580bd731"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"5.0"},{"fixed":"5.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107797.json","vanir_signatures":[{"digest":{"function_hash":"7978373696710798170237061069043931066","length":200},"id":"CVE-2026-107797-10a379ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"file":"src/com/jdon/jivejdon/manager/mapreduce/ThreadApprovedNewList.java","function":"init"},"deprecated":false},{"id":"CVE-2026-107797-4ff44e2f","signature_type":"Line","signature_version":"v1","source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"file":"src/com/jdon/jivejdon/manager/mapreduce/ThreadApprovedNewList.java"},"deprecated":false,"digest":{"line_hashes":["333860100309000275166928495311066973273","30374915342250970483952060235316732239","81414220211742601704501984076563483847","244416318735342282021764486528743115723","167518763580457859731317481743166481880","271811835294668748424500623578188102863","204948462349554106346462956643280388044","97713261130110039020207586332188831138","309120669949091627681488697821745157699","122748421947153433519081177395231259875","274218177332917631892721971919088235599","41599629172191896058670402327105764117"],"threshold":0.9}},{"source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"file":"src/com/jdon/jivejdon/model/query/specification/ApprovedListSpec.java","function":"isGoodBlog"},"deprecated":false,"digest":{"function_hash":"59108126195409344060918265431689748972","length":137},"id":"CVE-2026-107797-93c70820","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["185872278007795743557176473001778055140","59525279059624323695607473526051408613","83836500981196697398857103665689467409","121042032624974575198768221417924276931","14004420241609524477760040696659733821","263304077165190376358226209903951123852","49024321835583048676978449252886730798","100467887348313484870724408666892608408"]},"id":"CVE-2026-107797-a326d684","signature_type":"Line","signature_version":"v1","source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"file":"src/com/jdon/jivejdon/model/query/specification/ApprovedListSpec.java"}},{"deprecated":false,"digest":{"function_hash":"147664211641395977390983720950410247303","length":197},"id":"CVE-2026-107797-c28eb86c","signature_type":"Function","signature_version":"v1","source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"file":"src/com/jdon/jivejdon/manager/mapreduce/ThreadApprovedNewList.java","function":"start"}},{"signature_version":"v1","source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"file":"src/com/jdon/jivejdon/model/query/specification/ApprovedListSpec.java","function":"isExcelledDiscuss"},"deprecated":false,"digest":{"length":122,"function_hash":"162596087330417603063677428201438723389"},"id":"CVE-2026-107797-d0745307","signature_type":"Function"},{"digest":{"function_hash":"208972022311035733844886350694903749572","length":37},"id":"CVE-2026-107797-fd0b7e4d","signature_type":"Function","signature_version":"v1","source":"https://github.com/banq/jivejdon/commit/910fafbfa718d0a2be6bb034fa02bcbb580bd731","target":{"function":"run","file":"src/com/jdon/jivejdon/manager/mapreduce/ThreadApprovedNewList.java"},"deprecated":false}],"vanir_signatures_modified":"2026-10-11T07:05:41Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}]}