PatchTheCVE: xxl-jobhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-9264: A vulnerability was found in Xuxueli xxl-job up to 3.1.1https://patchthecve.com/cve/CVE-2025-9264.htmlhttps://patchthecve.com/cve/CVE-2025-9264.htmlWed, 17 Jun 2026 10:08:38 +0000MEDIUM 5.4: A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource ideCVE-2025-9263: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1https://patchthecve.com/cve/CVE-2025-9263.htmlhttps://patchthecve.com/cve/CVE-2025-9263.htmlWed, 17 Jun 2026 10:08:38 +0000MEDIUM 4.3: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. ThCVE-2025-7789: A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematichttps://patchthecve.com/cve/CVE-2025-7789.htmlhttps://patchthecve.com/cve/CVE-2025-7789.htmlWed, 17 Jun 2026 10:05:39 +0000LOW 3.7: A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insuffiCVE-2025-7788: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as criticalhttps://patchthecve.com/cve/CVE-2025-7788.htmlhttps://patchthecve.com/cve/CVE-2025-7788.htmlWed, 17 Jun 2026 10:05:39 +0000MEDIUM 6.3: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack cCVE-2025-7787: A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1https://patchthecve.com/cve/CVE-2025-7787.htmlhttps://patchthecve.com/cve/CVE-2025-7787.htmlWed, 17 Jun 2026 10:05:39 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch thCVE-2024-42681: Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via thttps://patchthecve.com/cve/CVE-2024-42681.htmlhttps://patchthecve.com/cve/CVE-2024-42681.htmlWed, 17 Jun 2026 07:49:53 +0000HIGH 8.8: Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.CVE-2024-3366: A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1https://patchthecve.com/cve/CVE-2024-3366.htmlhttps://patchthecve.com/cve/CVE-2024-3366.htmlWed, 17 Jun 2026 07:44:08 +0000LOW 3.5: A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to thCVE-2024-24113: xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to https://patchthecve.com/cve/CVE-2024-24113.htmlhttps://patchthecve.com/cve/CVE-2024-24113.htmlWed, 17 Jun 2026 07:14:07 +0000HIGH 8.8: xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.