CVE-2026-90489— Xuxueli xxl-job insert cross site scripting
Quick assessment
Affected
Xuxueli xxl-job
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Xuxueli xxl-job 3.5.0 及更早版本中发现一个漏洞，该漏洞影响 接口中未知的代码逻辑。攻击者可以通过操纵 和 参数触发跨站脚本（XSS）攻击。该攻击可远程执行。该漏洞的利用方式已公开披露，可能正被利用。安全团队已提前联系厂商，但对方未作出任何回应。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90489
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Xuxueli xxl-job insert cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90489
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90489
请登录查看更多情报信息。
Other References for CVE-2026-90489 (1)
Same Patch Batch · Xuxueli · 2026-09-12 · 3 CVEs total
| CVE-2026-90488 | 6.3 MEDIUM | Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection |
| CVE-2026-90487 | 4.3 MEDIUM | Xuxueli xxl-job JobGroupController.java privileges management |
IV. Related Vulnerabilities
Same product: xxl-job
-
CVE-2026-90488
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClas -
CVE-2026-90487
Xuxueli xxl-job JobGroupController.java privileges managemen -
CVE-2026-65316
xxl-job Cross-Job-Group Log Disclosure via Missing Authoriza -
CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard -
CVE-2026-7305
Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java trig
Same vendor: Xuxueli
-
CVE-2026-90488
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClas -
CVE-2026-90487
Xuxueli xxl-job JobGroupController.java privileges managemen -
CVE-2026-65316
xxl-job Cross-Job-Group Log Disclosure via Missing Authoriza -
CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard -
CVE-2026-7305
Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java trig
Same weakness: CWE-79
-
CVE-2026-10148
Booking for Appointments and Events Calendar – Amelia <= 2.4 -
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Paramete -
CVE-2026-90443
软件未认证反射型XSS漏洞 -
CVE-2026-54165
Stored DOM-XSS in public shared-folder image gallery (one-cl -
CVE-2026-81918
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the
V. Comments for CVE-2026-90489
No comments yet