xxl-job
Xuxueli
- Product type
- Software application
- Catalog vulnerabilities
- 32
Severity across 14 analyzed records
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Severity across 14 analyzed records
Verify to analyze this security profile
As of 09/13/2026, within CyStack's analyzed data, xxl-job has 4 security vulnerabilities published in the last 90 days. Of these, 1 is rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of xxl-job and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-90489Xuxueli xxl-job insert cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Published09/12/2026 | SeverityMedium |
CVE-2026-90488Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection | Exploitation statusPublic exploit | FixNot confirmed | Published09/12/2026 | SeverityMedium |
CVE-2026-90487Xuxueli xxl-job JobGroupController.java privileges management | Exploitation statusPublic exploit | FixNot confirmed | Published09/12/2026 | SeverityMedium |
CVE-2026-65316xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat | Exploitation statusNot known exploited | FixNot confirmed | Published07/21/2026 | SeverityHigh |
CVE-2026-7306Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key | Exploitation statusPublic exploit | FixNot confirmed | Published04/28/2026 | SeverityMedium |
CVE-2026-7305Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery | Exploitation statusPublic exploit | FixYes | Published04/28/2026 | SeverityMedium |
CVE-2026-7303Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection | Exploitation statusPublic exploit | FixYes | Published04/28/2026 | SeverityMedium |
CVE-2026-3733xuxueli xxl-job JobInfoController.java server-side request forgery | Exploitation statusPublic exploit | FixNot confirmed | Published03/08/2026 | SeverityMedium |
CVE-2025-9264Xuxueli xxl-job Jobs JobInfoController.java remove resource injection | Exploitation statusPublic exploit | FixNot confirmed | Published08/20/2025 | SeverityMedium |
CVE-2025-9263Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection | Exploitation statusPublic exploit | FixNot confirmed | Published08/20/2025 | SeverityMedium |
CVE-2025-7789Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash | Exploitation statusPublic exploit | FixNot confirmed | Published07/18/2025 | SeverityMedium |
CVE-2025-7788Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection | Exploitation statusPublic exploit | FixNot confirmed | Published07/18/2025 | SeverityMedium |
CVE-2025-7787Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery | Exploitation statusPublic exploit | FixNot confirmed | Published07/18/2025 | SeverityMedium |
CVE-2024-42681 | Exploitation statusPublic exploit | FixNot confirmed | Published08/15/2024 | SeverityHigh |
CVE-2024-3366Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection | Exploitation statusPublic exploit | FixNot confirmed | Published04/06/2024 | SeverityLow |
CVE-2024-24113 | Exploitation statusPublic exploit | FixNot confirmed | Published02/08/2024 | SeverityHigh |
CVE-2023-48088 | Exploitation statusPublic exploit | FixNot confirmed | Published11/15/2023 | SeverityUnknown |
CVE-2023-48087 | Exploitation statusPublic exploit | FixNot confirmed | Published11/15/2023 | SeverityUnknown |
CVE-2023-48089 | Exploitation statusNot known exploited | FixNot confirmed | Published11/15/2023 | SeverityHigh |
CVE-2020-24922 | Exploitation statusPublic exploit | FixNot confirmed | Published08/11/2023 | SeverityUnknown |
CVE-2023-33779 | Exploitation statusPublic exploit | FixNot confirmed | Published05/26/2023 | SeverityHigh |
CVE-2023-26120 | Exploitation statusNot known exploited | FixNot confirmed | Published04/10/2023 | SeverityMedium |
CVE-2023-27087 | Exploitation statusPublic exploit | FixNot confirmed | Published03/21/2023 | SeverityHigh |
CVE-2023-0674XXL-JOB New Password updatePwd cross-site request forgery | Exploitation statusPublic exploit | FixNot confirmed | Published02/04/2023 | SeverityMedium |
CVE-2022-43183 | Exploitation statusPublic exploit | FixNot confirmed | Published11/17/2022 | SeverityHigh |
CVE-2022-40929 | Exploitation statusPublic exploit | FixNot confirmed | Published09/28/2022 | SeverityCritical |
CVE-2022-36157 | Exploitation statusNot confirmed | FixNot confirmed | Published08/19/2022 | SeverityUnknown |
CVE-2022-29770 | Exploitation statusNot confirmed | FixNot confirmed | Published06/03/2022 | SeverityUnknown |
CVE-2022-29002 | Exploitation statusNot confirmed | FixNot confirmed | Published05/23/2022 | SeverityUnknown |
CVE-2020-29204 | Exploitation statusNot confirmed | FixNot confirmed | Published12/27/2020 | SeverityUnknown |
CVE-2020-23814 | Exploitation statusNot confirmed | FixNot confirmed | Published09/03/2020 | SeverityUnknown |
CVE-2020-23811 | Exploitation statusNot confirmed | FixNot confirmed | Published09/03/2020 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
