CVE-2026-107830

MediumCVSS 5.3/10Last modified Oct 13, 2026

Description

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-799

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1078314.3Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by aCVE-2026-1078323.7fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names deCVE-2026-1078335.9OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/boCVE-2026-1078345.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internalCVE-2026-1078354.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in interCVE-2026-1078367.1RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and eCVE-2026-1078378.2RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and eCVE-2026-1078387.5RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 202CVE-2026-1078397.5ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games.CVE-2026-1078407.5yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/seCVE-2026-1078415.7pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guCVE-2026-1078425.3Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed