PowerJob vulnerabilities
We track 6 vulnerabilities in PowerJob products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on August 31, 2026.
Latest PowerJob vulnerabilities
- 7.3 High severity
PowerJob: Server-Side Request Forgery
A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the componen
- 7.3 High severity
PowerJob: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code
- 7.3 High severity
PowerJob: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. Th
- 9.8 Critical severity
PowerJob: Server-Side Request Forgery
A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argu
- 7.5 High severity
PowerJob: Missing Authorization
A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAPIController. Such manipulation leads to missing authorization. The attack can be launched remotely. T
- 7.5 High severity
Powerjob: Improper Access Control
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.