CVE-2026-26719

설명 요약 xxl-job-admin의 JobInfoController.java에서 addressList 매개변수가 검증되지 않은 URL 인코딩 자바스크립트를 허용하여 저장형 크로스 사이트 스크립팅XSS 취약점이 존재합니다. 페이로드가 저장된 후 사용자의 브라우저에서 실행되어 허가되지 않은 작업을 초래합니다. 영향받는 제품 xxl-job 3.4.0 영향 xxl-job-admin v.3.4.0의 크로스 사이트 스크립팅 취약점으로 인해 원격 공격자가 악성 스크립트가 포함된 조작된 HTTP GET 요청을 통해 임의 코드를 실행할 수...

CVE-2026-26718

설명 요약 xxl-job-admin 웹 애플리케이션에는 공격자가 Glue IDE 셸 스크립트를 무단으로 수정할 수 있게 하는 CSRF사이트 간 요청 위조 취약점이 존재합니다. 영향을 받는 엔드포인트는 적절한 CSRF 토큰 검증이 없으며, 관대한 요청 매핑을 통해 임의의 HTTP 메서드를 허용합니다. 영향을 받는 제품 xxl-job history.pushState'', '', '/'; docu...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-52371

A Server-Side Request Forgery (SSRF) vulnerability exists in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 . This flaw allows authenticated attackers to scan internal resources by providing a crafted HTTP request , forcing the server to make requests to unintended locations. No in...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

EUVD-2026-44844

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...

EUVD-2026-44843

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-26719

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...

CVE-2026-26718

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-26718: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-26718

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-26719

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...

PT-2026-60331

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...

CVE-2026-26718

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application, affecting versions prior to 3.4.0 (specifically noted in version 3.0.0). The flaw stems from an endpoint that lacks proper CSRF token validation and utilizes a permissive request mapping that accepts ar...

CVE-2026-26719

A stored Cross-Site Scripting (XSS) vulnerability exists in xxl-job-admin (versions prior to 3.4.0 ) within the JobInfoController.java component. The root cause is that the addressList parameter accepts unsanitized URL-encoded JavaScript . An attacker can submit a malicious payload via a crafted ...

CVE-2026-26718

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-26719

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...

CVE-2026-26718

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-26719

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...