The vulnerability is a reflected cross‑site scripting flaw in the taggedThreadList.jsp page of Banq Jivejdon. Attackers can supply unencoded values in the tagID and count query parameters, causing the application to inject the payload directly into the HTML response. The injection is executed in the victim’s browser when the page is rendered, leading to potential theft of session cookies, social engineering, or defacement. The affected weakness is identified as CWE‑79, reflecting the lack of proper output encoding for user‑controlled data.

The flaw exists in the Jivejdon code from commit 5489372d up to commit ee67a65e. Users running any version of Banq Jivejdon that includes this code path are vulnerable; it does not require a logged‑in user, so all publicly accessible instances can be affected.

The CVSS base score of 5.3 denotes a moderate severity, indicating that the attacker’s ability to exploit requires only a standard HTTP request and no special credentials. The exploit is observable through crafted URLs containing malicious script fragments that close the open tag and execute JavaScript. Because the vulnerability is reflected, it relies on victims visiting the link, a common phishing scenario. There is currently no EPSS value or KEV listing, suggesting that while the flaw is known, it may not yet be widely exploited in the wild. Nonetheless, the ease of exploitation and the impact on client‑side confidentiality and integrity warrant prompt mitigation.