Banq Jivejdon
13 CVEs affecting Banq Jivejdon. Latest disclosed: 2026-10-08. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-107828 | Medium | 6.5 | 2026-10-08 | Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predict… |
CVE-2026-107797 | Medium | 6.1 | 2026-10-08 | Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via t… |
CVE-2026-107796 | Medium | 6.1 | 2026-10-08 | Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that al… |
CVE-2026-107829 | Medium | 5.9 | 2026-10-08 | Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql… |
CVE-2026-107801 | Medium | 5.4 | 2026-10-08 | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments wi… |
CVE-2026-107800 | Medium | 5.4 | 2026-10-08 | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages beca… |
CVE-2026-107799 | Medium | 5.4 | 2026-10-08 | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum mes… |
CVE-2026-107798 | Medium | 5.4 | 2026-10-08 | jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts… |
CVE-2026-107830 | Medium | 5.3 | 2026-10-08 | Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing… |
CVE-2025-71428 | Medium | 4.9 | 2026-10-08 | Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via… |
CVE-2026-107831 | Medium | 4.3 | 2026-10-08 | Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoint… |
CVE-2026-107793 | Medium | 4.3 | 2026-10-08 | Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete othe… |
CVE-2026-107792 | Medium | 4.3 | 2026-10-08 | Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated use… |