Jivejdon 5.0 and earlier expose a stored cross‑site scripting flaw that enables an authenticated attacker to inject and have the victim run arbitrary JavaScript within a private short message. The message body is rendered by receiveshortmessage.jsp without filtering, and ToolsUtil.convertURL() passes the payload unchanged, giving the attacker code execution in the recipient’s browser, which can compromise session data or facilitate phishing. The vulnerability is classified as CWE‑79 and carries a CVSS score of 5.1.

The affected product is Jivejdon, specifically all releases up to and including version 5.0.

The CVSS score of 5.1 indicates moderate severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who can send a private short message; the attacker must craft a message containing malicious script and the victim must open it in a browser. No additional network-level conditions are listed, so the exploit is constrained to messages exchanged within the application.