| Название | https://github.com/xuxueli/xxl-job xxl-job <=3.5.0 Stored Cross-Site Scripting Attack |
|---|
| Описание | In XXL-JOB versions <=3.5.0, the '/jobinfo/insert' interface's `name` parameter is vulnerable to Cross-Site Scripting (XSS). Normal users can construct strings containing malicious JavaScript code in the name and author parameters. When an administrator views the task management interface, these codes will be executed, potentially leading to the theft of sensitive information (such as cookies). |
|---|
| Источник | ⚠️ https://github.com/hhhh333/CVE/blob/main/xxl-job-xss%202.md |
|---|
| Пользователь | hhhha (UID 89875) |
|---|
| Представление | 17.07.2026 09:14 (2 месяцы назад) |
|---|
| Модерация | 20.09.2026 22:26 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 408060 [xuxueli xxl-job до 3.4.2/3.5.0 Task Management Interface JobInfoController.java name/author межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|