Vulnerabilities

TI-2026-63433 CVE-2026-94426 · GHSA-c8q7-hfwp-8gxx

xuxueli xxl-job insert cross site scripting

MEDIUM 56

A vulnerability was determined in xuxueli xxl-job up to 3.5.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00331 Published 2026-09-21 No fix listed CWE-79

TI-2026-63350 CVE-2026-94145 · GHSA-xr2h-v539-xc2h

xuxueli xxl-job Task Management JobInfoController.java cross site scripting

MEDIUM 56

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00331 Published 2026-09-21 No fix listed CWE-79

TI-2026-61507 CVE-2026-90489 · GHSA-hrg9-rfpj-46w2

Xuxueli xxl-job insert cross site scripting

MEDIUM 56

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00331 Published 2026-09-12 No fix listed CWE-79

TI-2026-61506 CVE-2026-90488 · GHSA-x282-35xq-g9q7

Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection

MEDIUM 57

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00393 Published 2026-09-12 No fix listed CWE-74

TI-2026-61505 CVE-2026-90487 · GHSA-w26j-6rp4-vhj5

Xuxueli xxl-job JobGroupController.java privileges management

LOW 24

A vulnerability was found in Xuxueli xxl-job up to 3.4.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00348 Published 2026-09-12 No fix listed CWE-266

TI-2026-46522 CVE-2026-65316 · GHSA-7359-rm9q-rghc

xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

LOW 32

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequ…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00509 Published 2026-07-21 No fix listed CWE-639

TI-2026-06413 CVE-2026-7306 · GHSA-j928-gcq3-xr95

Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key

MEDIUM 61

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00327 Published 2026-04-28 No fix listed CWE-320

TI-2026-06412 CVE-2026-7305 · GHSA-j6qx-2x9m-x936

Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery

MEDIUM 57

A weakness has been identified in Xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00209 Published 2026-04-28 No fix listed CWE-918

TI-2026-06410 CVE-2026-7303 · GHSA-gw2x-mfwr-h46p

Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection

MEDIUM 61

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00419 Published 2026-04-28 Fixed in 3.4.0 CWE-99

TI-2026-03223 CVE-2026-3733 · GHSA-hpp2-r5c8-cwwc

xuxueli xxl-job JobInfoController.java server-side request forgery

MEDIUM 57

A vulnerability was detected in xuxueli xxl-job up to 3.3.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00243 Published 2026-03-08 No fix listed CWE-918

TI-2025-37743 CVE-2025-60646 · GHSA-w4r6-29hp-24wr

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api…

MEDIUM 60

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2025-11-12 No fix listed CWE-79

TI-2025-37742 CVE-2025-60645 · GHSA-wjh9-7v88-c76j

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add…

MEDIUM 62

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00161 Published 2025-11-12 No fix listed CWE-352

TI-2025-08495 CVE-2025-9264 · GHSA-gjx6-h8hm-c9rq

Xuxueli xxl-job Jobs JobInfoController.java remove resource injection

MEDIUM 57

A vulnerability was found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00362 Published 2025-08-20 Fixed in 3.2.0 CWE-99

TI-2025-08494 CVE-2025-9263 · GHSA-6rq7-m52p-8pqg

Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection

MEDIUM 57

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00337 Published 2025-08-20 Fixed in 3.2.0 CWE-99

TI-2025-07114 CVE-2025-7789 · GHSA-565h-44m8-4c2v

Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

MEDIUM 61

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2025-07-18 Fixed in 3.2.0 CWE-326

TI-2025-07113 CVE-2025-7788 · GHSA-7vq6-w2cf-mm9v

Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection

MEDIUM 57

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.04949 Published 2025-07-18 No fix listed CWE-77

TI-2025-07112 CVE-2025-7787 · GHSA-f8vw-8vgh-22r9

Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery

MEDIUM 57

A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00504 Published 2025-07-18 No fix listed CWE-918

TI-2025-06085 CVE-2025-6701 · GHSA-r26v-98qj-48q9

Xuxueli xxl-sso doLogin redirect

MEDIUM 56

A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00322 Published 2025-06-26 No fix listed CWE-601

TI-2025-06084 CVE-2025-6700 · GHSA-2jfg-73q2-24qv

Xuxueli xxl-sso login cross site scripting

MEDIUM 57

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00472 Published 2025-06-26 No fix listed CWE-79

TI-2024-28580 CVE-2024-42681 · GHSA-cpfp-m5qw-c4r3

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute…

HIGH 73

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00886 Published 2024-08-15 Fixed in 2.4.2 CWE-277

TI-2024-03150 CVE-2024-3366 · GHSA-2v42-xp3j-47m4

Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection

HIGH 75

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00945 Published 2024-04-06 No fix listed CWE-74

TI-2024-16006 CVE-2024-24113 · GHSA-c352-x843-ggpq

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes…

HIGH 73

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00565 Published 2024-02-08 No fix listed CWE-918

TI-2023-26030 CVE-2023-48089 · GHSA-x98f-2rgf-qwqh

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

MEDIUM 43

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01262 Published 2023-11-15 No fix listed

TI-2023-26029 CVE-2023-48088 · GHSA-6733-7rp7-vf3m

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

MEDIUM 58

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00399 Published 2023-11-15 No fix listed CWE-79

TI-2023-26028 CVE-2023-48087 · GHSA-3w8r-3jh9-89v9

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via…

MEDIUM 58

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00362 Published 2023-11-15 No fix listed CWE-732

Vulnerabilities

Filters