{"schema_version":1,"title":"Xuxueli vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Xuxueli: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106708, was published on 15 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/vendors/xuxueli","json_url":"https://junglewise.ai/threats/vendors/xuxueli.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/xuxueli","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":true,"counts":{"high":1,"all_time":13,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":6,"last_365_days":11},"latest":[{"cve":"CVE-2026-106708","cvss":8.8,"epss":0.003,"slug":"cve-2026-106708-xxl-job-3-5-0-snapshot-and-earlier-contains-a-cross-site-request","title":"XXL-JOB cross-site request forgery in user management","severity":"high","exploited":false,"published_at":"2026-10-15T20:17:06.42+00:00","url":"https://junglewise.ai/threats/cve-2026-106708-xxl-job-3-5-0-snapshot-and-earlier-contains-a-cross-site-request"},{"cve":"CVE-2026-106707","cvss":5.4,"epss":0.0017,"slug":"cve-2026-106707-xxl-job-3-5-0-snapshot-contains-a-stored-cross-site-scripting","title":"XXL-JOB stored cross-site scripting in job log page","severity":"medium","exploited":false,"published_at":"2026-10-15T18:17:23.84+00:00","url":"https://junglewise.ai/threats/cve-2026-106707-xxl-job-3-5-0-snapshot-contains-a-stored-cross-site-scripting"},{"cve":"CVE-2026-106706","cvss":5.4,"epss":0.0017,"slug":"cve-2026-106706-xxl-job-through-3-5-0-snapshot-is-vulnerable-to-stored-cross","title":"XXL-JOB stored XSS in job code editor","severity":"medium","exploited":false,"published_at":"2026-10-15T18:17:23.567+00:00","url":"https://junglewise.ai/threats/cve-2026-106706-xxl-job-through-3-5-0-snapshot-is-vulnerable-to-stored-cross"},{"cve":"CVE-2026-90489","cvss":3.5,"epss":0.0033,"slug":"cve-2026-90489-xuxueli-xxl-job-cross-site-scripting-in-job-info-insert","title":"Xuxueli xxl-job cross-site scripting in job info insert","severity":"low","exploited":false,"published_at":"2026-09-13T00:17:06.853+00:00","url":"https://junglewise.ai/threats/cve-2026-90489-xuxueli-xxl-job-cross-site-scripting-in-job-info-insert"},{"cve":"CVE-2026-90488","cvss":6.3,"epss":0.0039,"slug":"cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader","title":"Xuxueli xxl-job remote code execution in Groovy class loader","severity":"medium","exploited":false,"published_at":"2026-09-13T00:17:06.68+00:00","url":"https://junglewise.ai/threats/cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader"},{"cve":"CVE-2026-90487","cvss":4.3,"epss":0.0035,"slug":"cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller","title":"Xuxueli xxl-job privilege escalation in JobGroupController","severity":"medium","exploited":false,"published_at":"2026-09-12T23:17:01.307+00:00","url":"https://junglewise.ai/threats/cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller"},{"cve":"CVE-2026-52371","cvss":0,"slug":"cve-2026-52371-xxl-job-ssrf-in-jobinfo-trigger-component","title":"XXL-JOB SSRF in jobinfo trigger component","severity":"info","exploited":false,"published_at":"2026-07-31T22:17:02.673+00:00","url":"https://junglewise.ai/threats/cve-2026-52371-xxl-job-ssrf-in-jobinfo-trigger-component"},{"cve":"CVE-2026-65316","cvss":6.5,"slug":"cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint","title":"xuxueli XXL-JOB IDOR in logDetailCat endpoint","severity":"medium","exploited":false,"published_at":"2026-07-21T22:19:10.197+00:00","url":"https://junglewise.ai/threats/cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint"},{"cve":"CVE-2026-7306","cvss":5.6,"epss":0.0033,"slug":"cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint","title":"Xuxueli xxl-job hard-coded default token in OpenAPI endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:51.06+00:00","url":"https://junglewise.ai/threats/cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint"},{"cve":"CVE-2026-7305","cvss":6.3,"epss":0.0021,"slug":"cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint","title":"Xuxueli xxl-job SSRF in trigger Endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:50.893+00:00","url":"https://junglewise.ai/threats/cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint"},{"cve":"CVE-2026-7303","cvss":3.7,"epss":0.0066,"slug":"cve-2026-7303-xuxueli-xxl-job-idor-in-execution-log-handler","title":"Xuxueli xxl-job IDOR in Execution Log Handler","severity":"low","exploited":false,"published_at":"2026-04-28T22:16:50.72+00:00","url":"https://junglewise.ai/threats/cve-2026-7303-xuxueli-xxl-job-idor-in-execution-log-handler"},{"cve":"CVE-2025-60646","cvss":6.1,"epss":0.0021,"slug":"cve-2025-60646-a-stored-cross-site-scripting-xss-in-the-business-line-management","title":"A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute…","severity":"medium","exploited":false,"published_at":"2025-11-12T19:15:37.013+00:00","url":"https://junglewise.ai/threats/cve-2025-60646-a-stored-cross-site-scripting-xss-in-the-business-line-management"},{"cve":"CVE-2025-60645","cvss":6.5,"epss":0.0016,"slug":"cve-2025-60645-a-cross-site-request-forgery-csrf-in-xxl-api-v1-3-0-allows","title":"A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management…","severity":"medium","exploited":false,"published_at":"2025-11-12T18:15:35.773+00:00","url":"https://junglewise.ai/threats/cve-2025-60645-a-cross-site-request-forgery-csrf-in-xxl-api-v1-3-0-allows"}],"vendor":{"hub":true,"name":"Xuxueli","slug":"xuxueli","url":"https://junglewise.ai/threats/vendors/xuxueli"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-106708","cvss":8.8,"epss":0.003,"slug":"cve-2026-106708-xxl-job-3-5-0-snapshot-and-earlier-contains-a-cross-site-request","title":"XXL-JOB cross-site request forgery in user management","severity":"high","exploited":false,"published_at":"2026-10-15T20:17:06.42+00:00","url":"https://junglewise.ai/threats/cve-2026-106708-xxl-job-3-5-0-snapshot-and-earlier-contains-a-cross-site-request"},{"cve":"CVE-2025-60645","cvss":6.5,"epss":0.0016,"slug":"cve-2025-60645-a-cross-site-request-forgery-csrf-in-xxl-api-v1-3-0-allows","title":"A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management…","severity":"medium","exploited":false,"published_at":"2025-11-12T18:15:35.773+00:00","url":"https://junglewise.ai/threats/cve-2025-60645-a-cross-site-request-forgery-csrf-in-xxl-api-v1-3-0-allows"},{"cve":"CVE-2026-65316","cvss":6.5,"slug":"cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint","title":"xuxueli XXL-JOB IDOR in logDetailCat endpoint","severity":"medium","exploited":false,"published_at":"2026-07-21T22:19:10.197+00:00","url":"https://junglewise.ai/threats/cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint"},{"cve":"CVE-2026-90488","cvss":6.3,"epss":0.0039,"slug":"cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader","title":"Xuxueli xxl-job remote code execution in Groovy class loader","severity":"medium","exploited":false,"published_at":"2026-09-13T00:17:06.68+00:00","url":"https://junglewise.ai/threats/cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader"},{"cve":"CVE-2026-7305","cvss":6.3,"epss":0.0021,"slug":"cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint","title":"Xuxueli xxl-job SSRF in trigger Endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:50.893+00:00","url":"https://junglewise.ai/threats/cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint"},{"cve":"CVE-2025-60646","cvss":6.1,"epss":0.0021,"slug":"cve-2025-60646-a-stored-cross-site-scripting-xss-in-the-business-line-management","title":"A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute…","severity":"medium","exploited":false,"published_at":"2025-11-12T19:15:37.013+00:00","url":"https://junglewise.ai/threats/cve-2025-60646-a-stored-cross-site-scripting-xss-in-the-business-line-management"},{"cve":"CVE-2026-7306","cvss":5.6,"epss":0.0033,"slug":"cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint","title":"Xuxueli xxl-job hard-coded default token in OpenAPI endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:51.06+00:00","url":"https://junglewise.ai/threats/cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint"},{"cve":"CVE-2026-106707","cvss":5.4,"epss":0.0017,"slug":"cve-2026-106707-xxl-job-3-5-0-snapshot-contains-a-stored-cross-site-scripting","title":"XXL-JOB stored cross-site scripting in job log page","severity":"medium","exploited":false,"published_at":"2026-10-15T18:17:23.84+00:00","url":"https://junglewise.ai/threats/cve-2026-106707-xxl-job-3-5-0-snapshot-contains-a-stored-cross-site-scripting"},{"cve":"CVE-2026-106706","cvss":5.4,"epss":0.0017,"slug":"cve-2026-106706-xxl-job-through-3-5-0-snapshot-is-vulnerable-to-stored-cross","title":"XXL-JOB stored XSS in job code editor","severity":"medium","exploited":false,"published_at":"2026-10-15T18:17:23.567+00:00","url":"https://junglewise.ai/threats/cve-2026-106706-xxl-job-through-3-5-0-snapshot-is-vulnerable-to-stored-cross"},{"cve":"CVE-2026-90487","cvss":4.3,"epss":0.0035,"slug":"cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller","title":"Xuxueli xxl-job privilege escalation in JobGroupController","severity":"medium","exploited":false,"published_at":"2026-09-12T23:17:01.307+00:00","url":"https://junglewise.ai/threats/cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller"}],"generated_at":"2026-11-13T03:07:00.155039+00:00","technologies":[]}