CVE-2026-94145— xuxueli xxl-job Task Management JobInfoController.java cross site scripting
Quick assessment
Affected
xuxueli xxl-job
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 xuxueli xxl-job 的 3.4.2 及 3.5.0 及之前版本中发现了一个漏洞。该漏洞影响了组件“任务管理接口”中未知代码，具体位于文件 。通过对参数 或 的操纵，可触发跨站脚本攻击（XSS）。该攻击可远程发起。该漏洞利用方法已公开披露，可能被利用。厂商在早期已被告知此漏洞披露事宜，但未作出任何回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94145
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xuxueli xxl-job Task Management JobInfoController.java cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-94145
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94145
请登录查看更多情报信息。
Other References for CVE-2026-94145 (3)
-
-
-
🔗 VulDB | Security Check third-party-advisory
IV. Related Vulnerabilities
Same product: xxl-job
-
CVE-2026-90489
Xuxueli xxl-job insert cross site scripting -
CVE-2026-90488
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClas -
CVE-2026-90487
Xuxueli xxl-job JobGroupController.java privileges managemen -
CVE-2026-65316
xxl-job Cross-Job-Group Log Disclosure via Missing Authoriza -
CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard
Same vendor: xuxueli
-
CVE-2026-90489
Xuxueli xxl-job insert cross site scripting -
CVE-2026-90488
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClas -
CVE-2026-90487
Xuxueli xxl-job JobGroupController.java privileges managemen -
CVE-2026-65316
xxl-job Cross-Job-Group Log Disclosure via Missing Authoriza -
CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard
Same weakness: CWE-79
-
CVE-2026-94150
Omega Solution HRM OS SVG File Upload view cross site script -
CVE-2026-94045
newbee-ltd newbee-mall Goods Save Endpoint UploadController. -
CVE-2026-94035
SourceCodester Drug Recommendation System index.php cross si -
CVE-2026-94034
SourceCodester Drug Recommendation System Password Change ch -
CVE-2026-94033
SourceCodester Drug Recommendation System User Management ad
V. Comments for CVE-2026-94145
No comments yet