PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

PowerJob V4.3.1 - Authentication Bypass

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. id: CVE-2023-29922 info: name: PowerJob V4.3.1 - Authentication Bypass author: Co5mos severity: medium description: | PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save...

Powerjob-CVE-2023-29922-

Powerjob-CVE-2023-29922-...

CVE-2026-75431_PowerJob_jwt_key_predictable

PowerJob JWT 签名密钥可预测（密钥由默认 JDBC URL 派生）→ 令牌伪造 1. 概述 PowerJob Server 的 JWT（HS256）签名密钥是通过对硬编码常量与默认 JDBC URL 的 MD5 拼接结果进行 BASE64 解码 而派生的（DefaultSecretProvider / JwtServiceImpl）。在默认部署（docker-compose / application-daily.properties）中，JDBC URL 是公开的，因此攻击者可以完全离线推导出密钥 ，并为任何用户（包括管理员）伪造有效的 JWT；OpenAPI...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

PowerJob Worker 通过 /worker/deployContainer 未授权远程代码执行（任意 JAR 加载） 1. 概述 PowerJob Worker 在其 HTTP 传输端口 27777 上暴露了 deployContainer 处理器，且完全没有身份验证 。攻击者提交一个任意 URL；Worker 会下载该 JAR 并通过 URLClassLoader + Spring ClassPathXmlApplicationContext 加载它，在 Spring init-method 期间执行任意代码 → Worker RCE 。默认的 docker-compose...

CVE-2026-75429_PowerJob_friend_process_RCE

PowerJob 服务器通过未认证的 /friend/process（Groovy 注入）实现远程代码执行 1. 概述 PowerJob 服务器（分布式任务调度/计算框架）在其 Worker↔Server 传输层 HTTP 端口 10010 上暴露了 /friend/process 端点，且完全没有身份认证 。该端点会反射调用任意 Spring Bean 的任意公共方法；攻击者调用 GroovyEvaluator.evaluate 即可执行任意 Groovy 表达式，实现未认证的远程代码执行 。默认的 docker-compose 将该端口发布到...

CVE-2023-29923-Scan

CVE-2023-29923-Scan PowerJob =4.3.2 未承認アクセス脆弱性検出ツール（CVE-2023-29922）...

CVE-2023-29923

PowerJob V4.3.1 未認証の脆弱性 このプロジェクトを使用して、WebサイトにCVE-2023-29923の脆弱性があるかどうかを確認でき、バッチ検証もサポートしています 使用方法： 1. python3 CVE-2023-29923.py -u "http://ip:port" 2. python3 CVE-2023-29923.py -f url.txt...

PowerJob List - Authorization Bypass

PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges. id: CVE-2025-11580 info: name: PowerJob List - Authorization Bypass author: DhiyaneshDk severit...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness through the JWT signing flow in DefaultSecretProvider and JwtServiceImpl under powerjob-server-auth. An attacker can forge HS256-signed JWTs by using the predictable signing key and then send those tokens to the serv...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

EUVD-2026-71612

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-75429

PowerJob (distributed job scheduling/computing framework) versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint on the Worker↔Server transport-layer HTTP port 10010 . The endpoint reflects arbitrary public methods of arbitrary Sp...

PT-2026-85685

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

EUVD-2026-71453

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75430

PowerJob Worker version 5.1.2 (and likely earlier) exposes the /worker/deployContainer HTTP endpoint without authentication on its default transport port, allowing a remote unauthenticated attacker to execute arbitrary code . The vulnerability is scored CVSS 9.8 (Critical) — network attack vector...