CVE-2026-90487

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. It affects unknown code in JobInfoController.java of the Task Management Interface. Manipulation of the argument name/author leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.

A vulnerability was identified in Xuxueli xxl-job up to version 3.5.0. Unknown code in /jobinfo/insert mishandles the name/author arguments, leading to cross site scripting (XSS). The attack can be executed remotely and the exploit is publicly available.

A vulnerability was determined in Xuxueli xxl-job up to version 3.4.2. The GroovyClassLoader.parseClass function in GlueFactory.java mishandles data, leading to code injection. The attack can be performed remotely and the exploit is publicly available.

xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.

XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.