https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-60646.htmlhttps://patchthecve.com/cve/CVE-2025-60646.htmlWed, 17 Jun 2026 09:49:54 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.https://patchthecve.com/cve/CVE-2025-60645.htmlhttps://patchthecve.com/cve/CVE-2025-60645.htmlWed, 17 Jun 2026 09:49:54 +0000MEDIUM 6.5: A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.https://patchthecve.com/cve/CVE-2025-9264.htmlhttps://patchthecve.com/cve/CVE-2025-9264.htmlWed, 17 Jun 2026 10:08:38 +0000MEDIUM 5.4: A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource idehttps://patchthecve.com/cve/CVE-2025-9263.htmlhttps://patchthecve.com/cve/CVE-2025-9263.htmlWed, 17 Jun 2026 10:08:38 +0000MEDIUM 4.3: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. Thhttps://patchthecve.com/cve/CVE-2025-7789.htmlhttps://patchthecve.com/cve/CVE-2025-7789.htmlWed, 17 Jun 2026 10:05:39 +0000LOW 3.7: A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insuffihttps://patchthecve.com/cve/CVE-2025-7788.htmlhttps://patchthecve.com/cve/CVE-2025-7788.htmlWed, 17 Jun 2026 10:05:39 +0000MEDIUM 6.3: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack chttps://patchthecve.com/cve/CVE-2025-7787.htmlhttps://patchthecve.com/cve/CVE-2025-7787.htmlWed, 17 Jun 2026 10:05:39 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch thhttps://patchthecve.com/cve/CVE-2025-6701.htmlhttps://patchthecve.com/cve/CVE-2025-6701.htmlWed, 17 Jun 2026 10:02:24 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-server/doLogin. The manipulation of the argument redirect_url leads to open redirect. The attack may be initiated remotely. The exploit has bhttps://patchthecve.com/cve/CVE-2025-6700.htmlhttps://patchthecve.com/cve/CVE-2025-6700.htmlWed, 17 Jun 2026 10:02:24 +0000MEDIUM 4.3: A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to thhttps://patchthecve.com/cve/CVE-2024-42681.htmlhttps://patchthecve.com/cve/CVE-2024-42681.htmlWed, 17 Jun 2026 07:49:53 +0000HIGH 8.8: Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.https://patchthecve.com/cve/CVE-2024-3366.htmlhttps://patchthecve.com/cve/CVE-2024-3366.htmlWed, 17 Jun 2026 07:44:08 +0000LOW 3.5: A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to th