Vulnerabilities

TI-2025-37743 CVE-2025-60646 · GHSA-w4r6-29hp-24wr

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api…

MEDIUM 60

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2025-11-12 No fix listed CWE-79

TI-2025-37742 CVE-2025-60645 · GHSA-wjh9-7v88-c76j

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add…

MEDIUM 62

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00161 Published 2025-11-12 No fix listed CWE-352

Vulnerabilities

Filters

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api…

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add…