Is CVE-2026-107796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107796 being exploited in the wild.

How severe is CVE-2026-107796?

Medium severity, with a CVSS score of 6.1, published 8 October 2026.

Which products and versions are affected?

Banq Jivejdon commit 5489372d through commit ee67a65e.

Is there a fix for CVE-2026-107796?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107796 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107796?

Check whether you run Banq Jivejdon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107796: Jivejdon reflected cross-site scripting in taggedThreadList.jsp

CVE-2026-107796 · Severity: medium · CVSS 6.1 · Published 2026-10-08

Jivejdon is a community forum and notebook application. An unauthenticated attacker can craft a malicious link that injects JavaScript code into the page, which executes in a victim's browser when they visit the link. This allows the attacker to steal session cookies, redirect users to phishing sites, or perform actions on behalf of the victim.

Technologies: Banq Jivejdon. Vendors: Banq.

Quick answers

Is CVE-2026-107796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107796 being exploited in the wild.
How severe is CVE-2026-107796?: Medium severity, with a CVSS score of 6.1, published 8 October 2026.
Which products and versions are affected?: Banq Jivejdon commit 5489372d through commit ee67a65e.
Is there a fix for CVE-2026-107796?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107796 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107796?: Check whether you run Banq Jivejdon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the taggedThreadList.jsp component where the tagID and count parameters are rendered into HTML without proper encoding. An unauthenticated attacker can trigger the vulnerability by crafting a URL with a script-closing payload in either parameter when the start parameter exceeds zero, causing arbitrary JavaScript execution in the victim's browser.

Affected products

banq Jivejdon commit 5489372d through commit ee67a65e

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.