Xuxueli

Records39All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

Xuxueli records in CISA KEV

No Xuxueli vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Xxl-job 24 records HIGH Xxl-api 2 records MEDIUM Xxl-sso 2 records MEDIUM Xxl-conf 1 record LOW

Records

39 records

TI-2022-19486 CVE-2022-40929 · GHSA-m54f-rp6r-rrrm

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.

HIGH 82

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01623 Published 2022-09-28 No fix listed CWE-78

TI-2024-03150 CVE-2024-3366 · GHSA-2v42-xp3j-47m4

Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection

HIGH 75

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00945 Published 2024-04-06 No fix listed CWE-74

TI-2024-28580 CVE-2024-42681 · GHSA-cpfp-m5qw-c4r3

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute…

HIGH 73

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00886 Published 2024-08-15 Fixed in 2.4.2 CWE-277

TI-2024-16006 CVE-2024-24113 · GHSA-c352-x843-ggpq

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes…

HIGH 73

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00565 Published 2024-02-08 No fix listed CWE-918

TI-2023-16685 CVE-2023-33779 · GHSA-9mmj-64jh-ph9c

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute…

HIGH 73

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00949 Published 2023-05-26 No fix listed CWE-863

TI-2022-21069 CVE-2022-43183 · GHSA-83w4-x5w9-hf4h

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component…

HIGH 73

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01787 Published 2022-11-17 Fixed in 2.4.0 CWE-918

TI-2020-15243 CVE-2020-24922 · GHSA-jp5r-4x9q-4vcf

Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli…

HIGH 73

Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00503 Published 2023-08-11 No fix listed CWE-352

TI-2023-11912 CVE-2023-27087 · GHSA-jhjm-5xjg-mpqp

Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows…

HIGH 72

Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00642 Published 2023-03-21 No fix listed CWE-280

TI-2025-37742 CVE-2025-60645 · GHSA-wjh9-7v88-c76j

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add…

MEDIUM 62

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00161 Published 2025-11-12 No fix listed CWE-352

TI-2026-06413 CVE-2026-7306 · GHSA-j928-gcq3-xr95

Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key

MEDIUM 61

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00327 Published 2026-04-28 No fix listed CWE-320

TI-2026-06410 CVE-2026-7303 · GHSA-gw2x-mfwr-h46p

Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection

MEDIUM 61

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00419 Published 2026-04-28 Fixed in 3.4.0 CWE-99

TI-2025-07114 CVE-2025-7789 · GHSA-565h-44m8-4c2v

Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

MEDIUM 61

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2025-07-18 Fixed in 3.2.0 CWE-326

TI-2025-37743 CVE-2025-60646 · GHSA-w4r6-29hp-24wr

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api…

MEDIUM 60

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2025-11-12 No fix listed CWE-79

TI-2023-26029 CVE-2023-48088 · GHSA-6733-7rp7-vf3m

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

MEDIUM 58

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00399 Published 2023-11-15 No fix listed CWE-79

TI-2023-26028 CVE-2023-48087 · GHSA-3w8r-3jh9-89v9

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via…

MEDIUM 58

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00362 Published 2023-11-15 No fix listed CWE-732

TI-2026-61506 CVE-2026-90488 · GHSA-x282-35xq-g9q7

Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection

MEDIUM 57

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00393 Published 2026-09-12 No fix listed CWE-74

TI-2026-06412 CVE-2026-7305 · GHSA-j6qx-2x9m-x936

Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery

MEDIUM 57

A weakness has been identified in Xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00209 Published 2026-04-28 No fix listed CWE-918

TI-2026-03223 CVE-2026-3733 · GHSA-hpp2-r5c8-cwwc

xuxueli xxl-job JobInfoController.java server-side request forgery

MEDIUM 57

A vulnerability was detected in xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00243 Published 2026-03-08 No fix listed CWE-918

TI-2025-08495 CVE-2025-9264 · GHSA-gjx6-h8hm-c9rq

Xuxueli xxl-job Jobs JobInfoController.java remove resource injection

MEDIUM 57

A vulnerability was found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00362 Published 2025-08-20 Fixed in 3.2.0 CWE-99

TI-2025-08494 CVE-2025-9263 · GHSA-6rq7-m52p-8pqg

Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection

MEDIUM 57

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00337 Published 2025-08-20 Fixed in 3.2.0 CWE-99

TI-2025-07113 CVE-2025-7788 · GHSA-7vq6-w2cf-mm9v

Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection

MEDIUM 57

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.04949 Published 2025-07-18 No fix listed CWE-77

TI-2025-07112 CVE-2025-7787 · GHSA-f8vw-8vgh-22r9

Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery

MEDIUM 57

A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00504 Published 2025-07-18 No fix listed CWE-918

TI-2025-06084 CVE-2025-6700 · GHSA-2jfg-73q2-24qv

Xuxueli xxl-sso login cross site scripting

MEDIUM 57

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00472 Published 2025-06-26 No fix listed CWE-79

TI-2026-63433 CVE-2026-94426 · GHSA-c8q7-hfwp-8gxx

xuxueli xxl-job insert cross site scripting

MEDIUM 56

A vulnerability was determined in xuxueli xxl-job up to 3.5.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00331 Published 2026-09-21 No fix listed CWE-79

TI-2026-63350 CVE-2026-94145 · GHSA-xr2h-v539-xc2h

xuxueli xxl-job Task Management JobInfoController.java cross site scripting

MEDIUM 56

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00331 Published 2026-09-21 No fix listed CWE-79

Open these records in search →

Critical	2
High	12
Medium	25
Low	0
No CVSS	0