Xuxueli vulnerabilities
We track 8 vulnerabilities in Xuxueli products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 18, 2025.
Latest Xuxueli vulnerabilities
- 8.8 High severity
xxl-job: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation lea
- 8.8 High severity
xxl-job: Server-Side Request Forgery
A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side requ
- 9.8 Critical severity
xxl-job: Deserialization of Untrusted Data
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injecti
- 8.8 High severity
Xxl-job: Incorrect Authorization
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
- 7.5 High severity
Xxl-job: Improper Handling of Insufficient Permissions or Privileges
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
- 9.8 Critical severity
Xxl-job: Improper Neutralization of Special Elements used in an OS Command
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
- 8.8 High severity
Xxl-job: Improper Privilege Management
XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.
- 8.8 High severity
Xxl-job: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.