EUVD-2023-1191

Malicious code in bioql PyPI...

cn.acyou:leo-framework-barcode (1.6.0.release), cn.acyou:leo-framework-commons (1.6.0.release) +185 more potentially affected by CVE-2024-42681 via com.xuxueli:xxl-job-core (>=2.0.1, <=2.4.1)

com.xuxueli:xxl-job-core MAVEN version =2.0.1, =1.0.7, =1.0.6, =1.2.3, =1.0.0-release, =0.0.8-release, =0.0.8-release, =1.0.0, =1.6.0, =1.6.154 and more Source cves: CVE-2024-42681 Source advisory: OSV:GHSA-CPFP-M5QW-C4R3...

Hardcoded credentials

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

CVE-2023-26120

CVE-2023-26120 affects com.xuxueli:xxl-job; multiple sources confirm an HTML payload can be executed via /xxl-job-admin/user/add and /xxl-job-admin/user/update, enabling cross-site scripting (XSS). Affected versions include 2.4.0 and earlier, with the issue originating from unsafe handling of HTM...

GHSA-7QQ9-9G2W-56F9 Improper Privilege Management in com.xuxueli:xxl-job

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account...