xxl-job

RCE por acceso no autorizado a la API RESTful del ejecutor xxl-job La consola de registros de ejecución permite obtener el resultado de la ejecución exitosa del comando: Ejemplo: /joblog/logDetailPage?id=xxxx Ver las variables de entorno del JDK String var3 = System.getProperties.toString;...

XXL-JOB v2.2.0 — Stored Cross Site Scripting

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file. id: CVE-2020-23814 info: name: XXL-JOB v2.2.0 — Stored Cross Site Scripting author:...

xuxueli__xxl-job_CVE-2020-29204_2-2-0

XXL-JOB XXL-JOB, a distributed task scheduling framework. -- Home Page -- Introduction XXL-JOB is a distributed task scheduling framework. It's core design goal is to deve...

CVE-2026-26719

Descripción Resumen Existe una vulnerabilidad de Cross‑Site Scripting almacenado en xxl-job-admin JobInfoController.java donde el parámetro addressList acepta JavaScript codificado en URL sin sanitizar. El payload se almacena y posteriormente se ejecuta en los navegadores de los usuarios, lo que...

CVE-2026-26718

Descripción Resumen Existe una vulnerabilidad de falsificación de solicitudes entre sitios CSRF en la aplicación web xxl-job-admin que permite a un atacante realizar modificaciones no autorizadas en los scripts de shell de Glue IDE. El endpoint afectado carece de una validación adecuada del token...

CVE-2026-94426

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-94426 xuxueli xxl-job insert cross site scripting

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-94426 xuxueli xxl-job insert cross site scripting

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-94426

xuxueli xxl-job up to version 3.5.0 is affected by a cross-site scripting (XSS) vulnerability in the /jobgroup/insert endpoint. The flaw is triggered by manipulating the Name argument, allowing a remote attacker to inject scripts that execute in a victim's browser. The CVSS 3.1 score is 3.5 (LOW)...

CVE-2026-94145

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94145 xuxueli xxl-job Task Management JobInfoController.java cross site scripting

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94145 xuxueli xxl-job Task Management JobInfoController.java cross site scripting

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

EUVD-2026-83844

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94145

A cross-site scripting (XSS) vulnerability affects xuxueli xxl-job versions up to 3.4.2/3.5.0 , specifically in the Task Management Interface component. The flaw resides in JobInfoController.java and is triggered by manipulation of the name or author argument, allowing a remote attacker with low ...

PT-2026-96046

Name of the Vulnerable Software and Affected Versions xuxueli xxl-job versions 3.4.2 and 3.5.0 Description A cross site scripting issue exists in the Task Management Interface within the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java. A remote attack...

CVE-2026-94426: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-94145: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

PT-2026-96319

Name of the Vulnerable Software and Affected Versions xuxueli xxl-job versions prior to 3.5.1 Description A remote attacker can initiate cross site scripting XSS—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the Name argument within an unknown...

EUVD-2026-76922

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

EUVD-2026-76921

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...