Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
CVE-2026-107830
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107830
jivejdon
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"product": "jivejdon",
"versions": [
{
"status": "affected",
"version": "e03060885db5726e46d30f55ac67920318d0d1fc",
"versionType": "git",
"lessThanOrEqual": "ee67a65e65228644a71c8317d7e34deea50f95ef"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-107830
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #20357 · Revision 1
- Added to Heist Feed
- Publisher date