CVE-2026-107796 — Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticat…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 4.0
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing payload in tagID or count, triggered when start exceeds zero, to execute JavaScript in victims' browsers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7