CVE-2026-107797

Name of the Vulnerable Software and Affected Versions Jivejdon versions prior to 5.1

Description A reflected cross-site scripting issue exists in the 'application/message/postThread.jsp' endpoint. This occurs because the application fails to properly encode inline JavaScript string literals, allowing attackers to inject scripts through the to and tag parameters. An attacker can execute arbitrary JavaScript within an authenticated user's session by sending a specially crafted link.

Recommendations Update Jivejdon to a version newer than 5.0. As a temporary mitigation, restrict access to the 'application/message/postThread.jsp' endpoint or avoid using the to and tag parameters.