CVE-2026-107830

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107830
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107830.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107830
Published
2026-10-08T21:51:34Z
Modified
2026-10-14T02:30:23Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint
Details

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-799"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107830.json"
}
References

Affected packages

Git / github.com/banq/jivejdon

Affected ranges

Type
GIT
Repo
https://github.com/banq/jivejdon
Events
Introduced
e03060885db5726e46d30f55ac67920318d0d1fc
Last Affected
ee67a65e65228644a71c8317d7e34deea50f95ef

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107830.json"