XX
Product
xxl-job
34
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 12Medium 15Low 5
Watch
Add xxl-job to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-3366 | 9.8 | Apr 6 | Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection Affected: 2.4.0; 2.4.1 |
| CVE-2022-40929 | 9.8 | Sep 28 | XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks Affected: 2.2.0 |
| CVE-2025-7788 | 8.8 | Jul 18 | Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection Affected: 3.1.0; 3.1.1 |
| CVE-2025-7787 | 8.8 | Jul 18 | Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery Affected: 3.1.0; 3.1.1 |
| CVE-2024-42681 | 8.8 | Aug 15 | Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component Affected: 2.4.1 |
| CVE-2024-24113 | 8.8 | Feb 8 | xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE Affected: through 2.4.1 |
| CVE-2023-48089 | 8.8 | Nov 15 | xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save Affected: 2.4.0 |
| CVE-2020-24922 | 8.8 | Aug 11 | Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate… Affected: 2.2.0 |
| CVE-2023-33779 | 8.8 | May 26 | A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component… Affected: 2.4.1 |
| CVE-2022-43183 | 8.8 | Nov 17 | XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java Affected: through 2.3.1 |
| CVE-2022-36157 | 8.8 | Aug 19 | XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account Affected: through 2.3.1 |
| CVE-2022-29002 | 8.8 | May 23 | A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add Affected: 2.3.0 |
| CVE-2023-27087 | 7.5 | Mar 21 | Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter Affected: 2.2.0; 2.3.0; 2.3.1 |
| CVE-2020-23811 | 7.5 | Sep 3 | xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java Affected: 2.2.0 |
| CVE-2026-65316 | 6.5 | Jul 21 | xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat Affected: through 2.4.2 |
| CVE-2023-0674 | 6.5 | Feb 4 | XXL-JOB New Password updatePwd cross-site request forgery Affected: 2.3.1 |
| CVE-2026-90488 | 6.3 | Sep 12 | Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection Affected: 3.4.0; 3.4.1; 3.4.2 |
| CVE-2026-7305 | 6.3 | Apr 28 | Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2026-3733 | 6.3 | Mar 8 | xuxueli xxl-job JobInfoController.java server-side request forgery Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2023-26120 | 6.1 | Apr 10 | This affects all versions of the package com.xuxueli:xxl-job Affected: All versions, or not specified |
| CVE-2020-29204 | 6.1 | Dec 27 | XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java Affected: 2.2.0 |
| CVE-2020-23814 | 6.1 | Sep 3 | Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in… Affected: 2.2.0 |
| CVE-2026-7306 | 5.6 | Apr 28 | Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2025-9264 | 5.4 | Aug 20 | Xuxueli xxl-job Jobs JobInfoController.java remove resource injection Affected: 3.1.0; 3.1.1 |
| CVE-2023-48088 | 5.4 | Nov 15 | xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage Affected: 2.4.0 |
| CVE-2023-48087 | 5.4 | Nov 15 | xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat Affected: 2.4.0 |
| CVE-2022-29770 | 5.4 | Jun 3 | XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo Affected: 2.3.0 |
| CVE-2026-90487 | 4.3 | Sep 12 | Xuxueli xxl-job JobGroupController.java privileges management Affected: 3.4.0; 3.4.1; 3.4.2 |
| CVE-2025-9263 | 4.3 | Aug 20 | Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection Affected: 3.1.0; 3.1.1 |
| CVE-2026-7303 | 3.7 | Apr 28 | Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2025-7789 | 3.7 | Jul 18 | Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash Affected: 3.1.0; 3.1.1 |
| CVE-2026-94426 | 3.5 | Sep 21 | xuxueli xxl-job insert cross site scripting Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0 |
| CVE-2026-94145 | 3.5 | Sep 21 | xuxueli xxl-job Task Management JobInfoController.java cross site scripting Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.4.0; +3 more |
| CVE-2026-90489 | 3.5 | Sep 12 | Xuxueli xxl-job insert cross site scripting Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0 |
Showing 34