xxl-job

RCE por acceso no autorizado a la API RESTful del ejecutor xxl-job La consola de registros de ejecución permite obtener el resultado de la ejecución exitosa del comando: Ejemplo: /joblog/logDetailPage?id=xxxx Ver las variables de entorno del JDK root@kitploit: String var3 =...

XXL-JOB v2.2.0 — Stored Cross Site Scripting

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file. id: CVE-2020-23814 info: name: XXL-JOB v2.2.0 — Stored Cross Site Scripting author:...

CVE-2026-26719

Description Summary A stored Cross‑Site Scripting vulnerability exists in xxl-job-admin JobInfoController.java where the addressList parameter accepts unsanitized URL‑encoded JavaScript. The payload is stored and later executed in users’ browsers, lead unauthorized actions. Affected Products...

CVE-2026-26718

Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via ...

xuxueli__xxl-job_CVE-2020-29204_2-2-0

root@kitploit: XXL-JOB XXL-JOB, a distributed task scheduling framework. -- Home Page --...

CVE-2026-90489

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90488

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2026-90487

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

CVE-2026-90488 Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-90488

Xuxueli xxl-job (up to 3.4.2 ) is vulnerable to code injection via the GroovyClassLoader.parseClass function in GlueFactory.java (xxl-job-core). The vulnerability allows remote exploitation with low complexity and low privileges required, resulting in a CVSS 3.1 score of 6.3 (MEDIUM) . A proof-of...

CVE-2026-90487 Xuxueli xxl-job JobGroupController.java privileges management

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

CVE-2026-90487

Xuxueli xxl-job versions up to 3.4.2 are affected by an improper privilege management flaw in the JobGroupController.java file within the xxl-job-admin module. The root cause is a missing authentication check on the loadById endpoint, allowing a remote, low-privilege attacker to access job group ...

PT-2026-90726

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

EUVD-2026-51656

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-52371

CVE-2026-52371 describes a Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger endpoint of xxl-job v3.4.0. The issue enables authenticated attackers to scan internal resources by sending a crafted HTTP request. The available documents identify the affected software/component a...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

PT-2026-66866

Name of the Vulnerable Software and Affected Versions xxl-job version 3.4.0 Description A Server-Side Request Forgery SSRF exists in the 'xxl-job-admin/jobinfo/trigger' endpoint. This issue allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF...