57 matches found
CVE-2026-26719
描述 摘要 xxl-job-admin 中的 JobInfoController.java 存在一个存储型跨站脚本（XSS）漏洞，其中 addressList 参数接受未经消毒的 URL 编码 JavaScript。该载荷被存储后，会在用户浏览器中执行，导致未授权操作。 受影响产品 root@kitploit: xxl-job 3.4.0 影响 xxl-job-admin v3.4.0 中的跨站脚本漏洞允许远程攻击者通过包含恶意脚本的精心构造的 HTTP GET 请求执行任意代码。 概念验证...
CVE-2026-26718
描述 摘要 xxl-job-admin Web 应用程序中存在跨站请求伪造（CSRF）漏洞，攻击者可利用该漏洞对 Glue IDE Shell 脚本进行未经授权的修改。受影响的端点缺少正确的 CSRF 令牌验证，并通过宽松的请求映射接受任意 HTTP 方法。 受影响产品 root@kitploit: xxl-job history.pushState'', '', '/'; document.forms0.submit...
CVE-2026-52371
CVE-2026-52371 describes a Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger endpoint of xxl-job v3.4.0. The issue enables authenticated attackers to scan internal resources by sending a crafted HTTP request. The available documents identify the affected software/component a...
CVE-2026-52371
A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...
EUVD-2026-44844
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
EUVD-2026-44843
A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...
CVE-2026-26719
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
CVE-2026-26718
A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...
CVE-2026-26719
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
CVE-2026-26718
CVE-2026-26718 – xxl-job-admin 3.0.0 CSRF flaw . A Cross-Site Request Forgery exists in the xxl-job-admin web application (v3.0.0) that enables an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitra...
CVE-2026-26718
A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...
CVE-2026-26719
CVE-2026-26719 affects xxl-job-admin v3.0.0 with a stored/reflected XSS in JobInfoController.java via unsanitized addressList (stored/URL-encoded JavaScript). Affected versions are
CVE-2026-26719
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
PT-2026-60330
Name of the Vulnerable Software and Affected Versions xxl-job-admin version 3.0.0 Description A Cross-Site Request Forgery CSRF issue exists in the web application. This occurs because a specific endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods through a permissive...
Resource Injection
Overview Affected versions of this package are vulnerable to Resource Injection via the logDetailCat function in the Execution Log Handler. An attacker can access unauthorized resources by obtaining a valid logId and sending requests directly to logDetailCat endpoint. Remediation Upgrade...
EUVD-2023-2894
Malicious code in bioql PyPI...
EUVD-2023-2867
Malicious code in bioql PyPI...
EUVD-2023-3060
Malicious code in bioql PyPI...
