medium6.1
CVE-2023-26120
XXL-JOB vulnerable to Cross-site Scripting
Impact
XXL-JOB (`com.xuxueli:xxl-job`) versions 2.4.0 and earlier are vulnerable to cross-site scripting (XSS). An HTML uploaded payload can be executed successfully through `/xxl-job-admin/user/add` and `/xxl-job-admin/user/update`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.xuxueli:xxl-job | <= 2.4.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xuxueli | Xxl-Job | All versions |