Stored Cross-Site Scripting Vulnerability in XXL-JOB by Xuxueli
CVE-2026-106707

5.4MEDIUM

Key Information:

Vendor

Xuxueli

Status
XXL-JOB
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106707?

XXL-JOB versions up to 3.5.0-SNAPSHOT are susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the job log list page. This flaw allows authenticated users with permissions on specific executor job groups to deliver arbitrary JavaScript code through the executorParam argument of the manual-trigger endpoint. If exploited, this vulnerability could lead to unwanted actions and data exposure, emphasizing the need for immediate remediation.

References

https://github.com/xuxueli/xxl-job
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.