Login Request a demo
XX
Product
xxl-job
by xuxueli · last CVE Sep 21, 2026
34
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities34In the news0Timeline
Severity mix
Critical 2High 12Medium 15Low 5
Severity
All severities34Critical2High12Medium15Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add xxl-job to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-7788
8.8
5%
Jul 18
Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection
Affected: 3.1.0; 3.1.1
CVE-2025-7787
8.8
1%
Jul 18
Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery
Affected: 3.1.0; 3.1.1
CVE-2024-42681
8.8
1%
Aug 15
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component
Affected: 2.4.1
CVE-2024-24113
8.8
1%
Feb 8
xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE
Affected: through 2.4.1
CVE-2023-48089
8.8
1%
Nov 15
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save
Affected: 2.4.0
CVE-2020-24922
8.8
1%
Aug 11
Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate…
Affected: 2.2.0
CVE-2023-33779
8.8
1%
May 26
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component…
Affected: 2.4.1
CVE-2022-43183
8.8
2%
Nov 17
XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java
Affected: through 2.3.1
CVE-2022-36157
8.8
2%
Aug 19
XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account
Affected: through 2.3.1
CVE-2022-29002
8.8
0%
May 23
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add
Affected: 2.3.0
CVE-2023-27087
7.5
1%
Mar 21
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter
Affected: 2.2.0; 2.3.0; 2.3.1
CVE-2020-23811
7.5
1%
Sep 3
xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java
Affected: 2.2.0
Showing 12