PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107796 banq CVE debrief

CVE-2026-107796 is a reflected cross-site scripting vulnerability in Jivejdon, a project maintained by banq, from commit 5489372d through commit ee67a65e. The vulnerability is located in the application/query/taggedThreadList.jsp file and allows unauthenticated attackers to inject script via unencoded tagID and count parameters. This vulnerability can be triggered when the start parameter exceeds zero, allowing attackers to execute JavaScript in victims' browsers. Defenders should prioritize verifying the presence of this vulnerability in their Jivejdon deployments and assess the exposure of their systems.

Vendor
banq
Product
jivejdon
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-08
Advisory published
2026-10-08
Advisory updated
2026-10-08

Who should care

Defenders responsible for Jivejdon deployments should assess the exposure of their systems to this vulnerability. This includes verifying the presence of the vulnerability in their deployments and taking steps to mitigate the vulnerability if it is present. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-107796 is a reflected cross-site scripting vulnerability in Jivejdon that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Defenders should prioritize verifying the presence of this vulnerability in their Jivejdon deployments and assess the exposure of their systems.

  • Defenders need to verify the presence of this vulnerability in their Jivejdon deployments.
  • Systems may be exposed to cross-site scripting attacks if not patched or mitigated.

Technical summary

The vulnerability is located in the application/query/taggedThreadList.jsp file and allows unauthenticated attackers to inject script via unencoded tagID and count parameters. This vulnerability can be triggered when the start parameter exceeds zero, allowing attackers to execute JavaScript in victims' browsers. The vulnerability affects Jivejdon deployments from commit 5489372d through commit ee67a65e. Defenders should prioritize verifying the presence of this vulnerability in their Jivejdon deployments and assess the exposure of their systems.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Jivejdon deployments and assess the exposure of their systems.

Recommended defensive actions

  • Verify the presence of this vulnerability in Jivejdon deployments
  • Assess the exposure of systems to this vulnerability
  • Apply patches or mitigations as available
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its location in the application/query/taggedThreadList.jsp file and the parameters affected. The vulnerability is a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. The source item provides additional context about the vulnerability, including the affected commits and the potential impact on deployments.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107796 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107796

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107796 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107796

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Paramete

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107796.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/banq/jivejdon/issues/28

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/banq/jivejdon

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/query/taggedThreadList.jsp

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-reflected-xss-via-taggedthreadlist-jsp-tagid-and-count-parameters

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.