XX
Product
xxl-job
34
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 12Medium 15Low 5
Watch
Add xxl-job to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-65316 | 6.5 | Jul 21 | xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat Affected: through 2.4.2 |
| CVE-2023-0674 | 6.5 | Feb 4 | XXL-JOB New Password updatePwd cross-site request forgery Affected: 2.3.1 |
| CVE-2026-90488 | 6.3 | Sep 12 | Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection Affected: 3.4.0; 3.4.1; 3.4.2 |
| CVE-2026-7305 | 6.3 | Apr 28 | Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2026-3733 | 6.3 | Mar 8 | xuxueli xxl-job JobInfoController.java server-side request forgery Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2023-26120 | 6.1 | Apr 10 | This affects all versions of the package com.xuxueli:xxl-job Affected: All versions, or not specified |
| CVE-2020-29204 | 6.1 | Dec 27 | XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java Affected: 2.2.0 |
| CVE-2020-23814 | 6.1 | Sep 3 | Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in… Affected: 2.2.0 |
| CVE-2026-7306 | 5.6 | Apr 28 | Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key Affected: 3.3.0; 3.3.1; 3.3.2 |
| CVE-2025-9264 | 5.4 | Aug 20 | Xuxueli xxl-job Jobs JobInfoController.java remove resource injection Affected: 3.1.0; 3.1.1 |
| CVE-2023-48088 | 5.4 | Nov 15 | xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage Affected: 2.4.0 |
| CVE-2023-48087 | 5.4 | Nov 15 | xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat Affected: 2.4.0 |
| CVE-2022-29770 | 5.4 | Jun 3 | XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo Affected: 2.3.0 |
| CVE-2026-90487 | 4.3 | Sep 12 | Xuxueli xxl-job JobGroupController.java privileges management Affected: 3.4.0; 3.4.1; 3.4.2 |
| CVE-2025-9263 | 4.3 | Aug 20 | Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection Affected: 3.1.0; 3.1.1 |
Showing 15