# CVE-2025-71428: Jivejdon SQL injection in AccountDaoSql.getAccountByNameLike()

Source: https://junglewise.ai/threats/cve-2025-71428-jivejdon-through-5-0-contains-a-sql-injection-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2025-71428 · Severity: medium · CVSS 4.9 · Published 2026-10-08

Jivejdon is a collaborative notebook and forum platform. Administrators with database access can exploit a SQL injection flaw in the user search function to extract sensitive database records, including password hashes of other user accounts, by submitting specially crafted usernames.

Technologies: [Banq Jivejdon](https://junglewise.ai/threats/technologies/banq-jivejdon). Vendors: [Banq](https://junglewise.ai/threats/vendors/banq).

## Quick answers

**Is CVE-2025-71428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71428 being exploited in the wild.

**How severe is CVE-2025-71428?** Medium severity, with a CVSS score of 4.9, published 8 October 2026.

**Which products and versions are affected?** Banq Jivejdon through 5.0.

**Is there a fix for CVE-2025-71428?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-71428 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-71428?** Check whether you run Banq Jivejdon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The AccountDaoSql.getAccountByNameLike() method fails to sanitize the username parameter before constructing SQL queries, allowing SQL injection attacks. An authenticated administrator can submit malicious input through the /admin/user/userListAction endpoint to execute arbitrary SQL and read database contents, including account password hashes.

## Affected products

- banq Jivejdon through 5.0

## Timeline

- 2026-10-08: disclosed

## References

- [https://github.com/banq/jivejdon](https://github.com/banq/jivejdon)
- [https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java](https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java)

## Related threats

- [Jivejdon SMS rate limiting bypass in unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-107830-jivejdon-from-commit-e0306088-through-commit-ee67a65e-lacks-rate)
- [jivejdon stored cross-site scripting in TextStyle filter](https://junglewise.ai/threats/cve-2026-107798-jivejdon-from-commit-595d8d22-through-commit-ee67a65e-contains-a)
- [Jivejdon reflected cross-site scripting in taggedThreadList.jsp](https://junglewise.ai/threats/cve-2026-107796-jivejdon-from-commit-5489372d-through-commit-ee67a65e-contains-a)
- [Jivejdon authorization bypass in subscription deletion](https://junglewise.ai/threats/cve-2026-107793-jivejdon-through-5-0-contains-an-authorization-bypass)