CVE-2026-94145
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. It affects unknown code in JobInfoController.java of the Task Management Interface. Manipulation of the argument name/author leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
Risk Assessment
The risk is the possibility of executing malicious scripts in the victim's browser, which could lead to session theft, account takeover, or other phishing attacks.
Recommendation
Update xxl-job to a patched version immediately, or apply temporary measures such as input filtering and output encoding to prevent XSS attacks.
Other vulnerabilities in xxl-job
See all- CVE-2026-94426Low
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-90489Low
A vulnerability was identified in Xuxueli xxl-job up to version 3.5.0. Unknown code in /jobinfo/insert mishandles the name/author arguments, leading to cross site scripting (XSS). The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-90488Medium
A vulnerability was determined in Xuxueli xxl-job up to version 3.4.2. The GroovyClassLoader.parseClass function in GlueFactory.java mishandles data, leading to code injection. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-90487Medium
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-52371Medium
xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.
- CVE-2026-65316Medium
XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.
- CVE-2023-33779High
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.
Original NVD description (English source)
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS