CVE-2025-7788: falha de média gravidade em Xuxueli xxl-job
Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 4.9%
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Xuxueli · xxl-jobCVEs relacionadas — Xuxueli xxl-job
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3366LOWXuxueli xxl-job Template JdkSerializeTool.java deserialize injectionEPSS 0.9%CVE-2025-7787MEDIUMXuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgeryEPSS 0.5%CVE-2026-7303MEDIUMXuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injectionEPSS 0.4%CVE-2026-90488MEDIUMXuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injectionEPSS 0.4%CVE-2025-9264MEDIUMXuxueli xxl-job Jobs JobInfoController.java remove resource injectionEPSS 0.4%CVE-2026-90487MEDIUMXuxueli xxl-job JobGroupController.java privileges managementEPSS 0.3%