CVE-2025-9264

<= 3.1.1

A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java

5.4MEDIUM

CVE-2025-9263

<= 3.1.1

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of th

4.3MEDIUM

CVE-2025-7789

<= 3.1.1

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function mak

3.7LOW

CVE-2025-7788

<= 3.1.1

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the fu

6.3MEDIUM

CVE-2025-7787

<= 3.1.1

A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandl

6.3MEDIUM

CVE-2024-42681

all versions

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID compo

8.8HIGH

CVE-2024-3366

< 2.4.1

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deseri

3.5LOW

CVE-2024-24113

<= 2.4.1

xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to

8.8HIGH

CVE-2023-48089

all versions

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

8.8HIGH

CVE-2023-48088

all versions

xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

5.4MEDIUM

CVE-2023-48087

all versions

xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCa

5.4MEDIUM

CVE-2020-24922

all versions

Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attacker

8.8HIGH

CVE-2023-33779

all versions

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's accoun

8.8HIGH

CVE-2023-26120

all versions

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/u

5.4MEDIUM

CVE-2023-27087

all versions

Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via

7.5HIGH

CVE-2023-0674

all versions

A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown func

4.3MEDIUM

CVE-2022-43183

<= 2.3.1

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

8.8HIGH

CVE-2022-40929

all versions

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is

9.8CRITICAL

CVE-2022-36157

<= 2.3.1

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function

8.8HIGH

CVE-2022-29770

all versions

XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.

5.4MEDIUM

CVE-2022-29002

all versions

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the compon

8.8HIGH

CVE-2020-29204

all versions

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/c

6.1MEDIUM

CVE-2020-23814

all versions

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTM

6.1MEDIUM

CVE-2020-23811

all versions

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

7.5HIGH