CVE-2026-94426
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session or data theft. The public disclosure of the exploit increases the risk of rapid exploitation.
Recommendation
Restrict access to the xxl-job interface to trusted networks and consider implementing input validation at the reverse proxy level. Monitor for vendor patches.
Other vulnerabilities in xxl-job
See all- CVE-2026-94145Low
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. It affects unknown code in JobInfoController.java of the Task Management Interface. Manipulation of the argument name/author leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
- CVE-2026-90489Low
A vulnerability was identified in Xuxueli xxl-job up to version 3.5.0. Unknown code in /jobinfo/insert mishandles the name/author arguments, leading to cross site scripting (XSS). The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-90488Medium
A vulnerability was determined in Xuxueli xxl-job up to version 3.4.2. The GroovyClassLoader.parseClass function in GlueFactory.java mishandles data, leading to code injection. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-90487Medium
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-52371Medium
xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.
- CVE-2026-65316Medium
XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.
- CVE-2023-33779High
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.
Original NVD description (English source)
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS