Vulnerabilities

TI-2025-08495 CVE-2025-9264 · GHSA-gjx6-h8hm-c9rq

Xuxueli xxl-job Jobs JobInfoController.java remove resource injection

MEDIUM 57

A vulnerability was found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00362 Published 2025-08-20 Fixed in 3.2.0 CWE-99

TI-2025-08494 CVE-2025-9263 · GHSA-6rq7-m52p-8pqg

Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection

MEDIUM 57

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00337 Published 2025-08-20 Fixed in 3.2.0 CWE-99

TI-2025-07114 CVE-2025-7789 · GHSA-565h-44m8-4c2v

Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

MEDIUM 61

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2025-07-18 Fixed in 3.2.0 CWE-326

TI-2025-07113 CVE-2025-7788 · GHSA-7vq6-w2cf-mm9v

Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection

MEDIUM 57

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.04949 Published 2025-07-18 No fix listed CWE-77

TI-2025-07112 CVE-2025-7787 · GHSA-f8vw-8vgh-22r9

Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery

MEDIUM 57

A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00504 Published 2025-07-18 No fix listed CWE-918

TI-2024-28580 CVE-2024-42681 · GHSA-cpfp-m5qw-c4r3

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute…

HIGH 73

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00886 Published 2024-08-15 Fixed in 2.4.2 CWE-277

TI-2024-03150 CVE-2024-3366 · GHSA-2v42-xp3j-47m4

Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection

HIGH 75

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00945 Published 2024-04-06 No fix listed CWE-74

TI-2024-16006 CVE-2024-24113 · GHSA-c352-x843-ggpq

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes…

HIGH 73

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00565 Published 2024-02-08 No fix listed CWE-918

TI-2023-26030 CVE-2023-48089 · GHSA-x98f-2rgf-qwqh

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

MEDIUM 43

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01262 Published 2023-11-15 No fix listed

TI-2023-26029 CVE-2023-48088 · GHSA-6733-7rp7-vf3m

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

MEDIUM 58

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00399 Published 2023-11-15 No fix listed CWE-79

TI-2023-26028 CVE-2023-48087 · GHSA-3w8r-3jh9-89v9

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via…

MEDIUM 58

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00362 Published 2023-11-15 No fix listed CWE-732

TI-2020-15243 CVE-2020-24922 · GHSA-jp5r-4x9q-4vcf

Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli…

HIGH 73

Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00503 Published 2023-08-11 No fix listed CWE-352

TI-2023-16685 CVE-2023-33779 · GHSA-9mmj-64jh-ph9c

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute…

HIGH 73

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00949 Published 2023-05-26 No fix listed CWE-863

TI-2023-11345 CVE-2023-26120 · GHSA-4j2p-x79m-jcj8

Cross-site scripting in com.xuxueli:xxl-job

LOW 28

This affects all versions of the package com.xuxueli:xxl-job.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00463 Published 2023-04-10 No fix listed CWE-79

TI-2023-11912 CVE-2023-27087 · GHSA-jhjm-5xjg-mpqp

Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows…

HIGH 72

Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00642 Published 2023-03-21 No fix listed CWE-280

TI-2023-00638 CVE-2023-0674 · GHSA-pv4m-h859-jwmq

XXL-JOB New Password updatePwd cross-site request forgery

LOW 29

A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00387 Published 2023-02-04 No fix listed CWE-352

TI-2022-21069 CVE-2022-43183 · GHSA-83w4-x5w9-hf4h

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component…

HIGH 73

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01787 Published 2022-11-17 Fixed in 2.4.0 CWE-918

TI-2022-19486 CVE-2022-40929 · GHSA-m54f-rp6r-rrrm

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.

HIGH 82

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01623 Published 2022-09-28 No fix listed CWE-78

TI-2022-16572 CVE-2022-36157 · GHSA-7qq9-9g2w-56f9

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting…

MEDIUM 41

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01489 Published 2022-08-19 Fixed in 2.4.0 CWE-269

TI-2022-12141 CVE-2022-29770 · GHSA-8gvg-f6qp-39wx

XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.

LOW 25

XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0053 Published 2022-06-03 No fix listed CWE-79

TI-2022-11580 CVE-2022-29002 · GHSA-v3c9-w6g2-hjg3

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily…

LOW 39

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00477 Published 2022-05-23 No fix listed CWE-352

TI-2020-17599 CVE-2020-29204 · GHSA-wc73-w5r9-x9pc

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via…

LOW 29

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00893 Published 2020-12-27 Fixed in 2.3.0 CWE-79

TI-2020-14676 CVE-2020-23814 · GHSA-pqqj-299w-wf53

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01434 Published 2020-09-03 Fixed in 2.3.0 CWE-79

TI-2020-14675 CVE-2020-23811 · GHSA-m5q9-488r-4rmp

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via…

LOW 35

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01154 Published 2020-09-03 No fix listed CWE-200

Vulnerabilities

Filters