CVE-2026-107830
5.3 MEDIUMpublic exploit availablePublished 2026-10-08 · Updated 2026-10-13
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-799
Public exploit & PoC references
- https://github.com/banq/jivejdon
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79
- https://github.com/banq/jivejdon/issues/28
All references
- https://github.com/banq/jivejdon
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79
- https://github.com/banq/jivejdon/issues/28
- https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-rate-limiting-via-account-smsvraction-sms-endpoint
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-13882
- MEDIUMCVE-2025-36045
- MEDIUMCVE-2026-100603PoC
- LOWCVE-2026-105237PoC
- LOWCVE-2026-111874PoC
- MEDIUMCVE-2026-82924
- UNSCOREDCVE-2026-84461PoC
- LOWCVE-2026-93650PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.