Xxl Job

xxl-job

Vendor: Xuxueli • 24 CVEs

CVEs (24)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-29002 1Xuxueli 1Xxl Job Jun 17, 2026 May 23, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
CVE-2020-29204 1Xuxueli 1Xxl Job Jun 17, 2026 Dec 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
CVE-2020-23814 1Xuxueli 1Xxl Job Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
CVE-2020-23811 1Xuxueli 1Xxl Job Jun 17, 2026 Sep 3, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.