CVE-2025-71428 — Jivejdon through 5.0 SQL Injection via username in userListAction
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username param…
Published: 2026-10-08 · CVSS: 6.9 · CVSS 4.0
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7