CVE-2025-71428

Name of the Vulnerable Software and Affected Versions Jivejdon versions prior to 5.1

Description An issue exists in the AccountDaoSql.getAccountByNameLike() function that allows authenticated administrators to perform SQL injection. By submitting crafted input to the /admin/user/userListAction endpoint via the username parameter, attackers with the Admin role can read database contents, including password hashes of other accounts.

Recommendations Update Jivejdon to a version later than 5.0. As a temporary workaround, restrict access to the /admin/user/userListAction endpoint or avoid using the username parameter in that endpoint until a patch is applied.