CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 expose the /friend/process endpoint on the Server-Worker transport layer (HTTP port 10010) without any authentication. An attacker can invoke an arbitrary public method on any Spring Bean; specifically, calling GroovyEvaluator.evaluate allows execution of arbit...