CVE-2025-60645

MediumCVSS 6.5

Published: 12/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

Risk Assessment

An attacker could trick a logged-in administrator into unknowingly adding unauthorized accounts. This leads to privilege escalation and system takeover.

Recommendation

Update xxl-api to a version containing the fix or implement CSRF protections such as anti-CSRF tokens and origin verification. Avoid performing state-changing operations via GET requests.

Other vulnerabilities in xxl-api

CVE-2025-60646Medium
A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Original NVD description (English source)

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS