CVE-2026-107799: Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in the browser of every user viewing the thread.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
An authenticated attacker with permission to post a forum message can inject script into a message body. The script executes in the browser of every user who views the affected discussion thread.
Does exploitation require a special configuration or complex attack path?
The issue is in normal forum message rendering: messageListBody.jsp renders message bodies with filtering disabled and non-escaping default filters. Exploitation requires a user to view a thread containing the attacker’s stored message.
How can administrators check whether their instance is affected?
Review the deployed messageListBody.jsp and its message-body rendering around the referenced lines for filter="false" and non-escaping filters. Also review existing forum messages for stored markup or script content, since previously posted payloads may execute when threads are viewed.