The vulnerability is a stored cross‑site scripting flaw that occurs when an authenticated user posts a message containing unsanitized script into a forum thread. The posted script is rendered by messageListBody.jsp with filtering disabled, causing it to execute in the browser of every user who later views the thread. This can lead to session hijacking, credential theft, and other browser‑side attacks for each affected user.

Banq Jivejdon versions through 5.0 are affected. The flaw exists in the message rendering component of Jivejdon’s forum where message bodies are processed without escaping or filtering.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with posting privileges to inject the malicious script, but once posted the exploit triggers automatically for every user viewing the thread. The lack of a publicly available exploit does not diminish the risk, as the vulnerable component is part of a user‑editable content area.