{"id":"CVE-2026-94145","published":"2026-09-21T07:16:53.810","lastModified":"2026-09-21T16:17:29.170","description":"A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":3.5,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-79","CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/xxl-job-xss%202.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-94145","tags":[]},{"url":"https://vuldb.com/submit/893853","tags":[]},{"url":"https://vuldb.com/vuln/408060","tags":[]},{"url":"https://vuldb.com/vuln/408060/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/hhhh333/CVE/blob/main/xxl-job-xss%202.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A cross-site scripting vulnerability exists in xxl-job versions up to 3.4.2/3.5.0 due to improper input handling, allowing attackers to inject malicious scripts via job names or authors.","exploitability":"Exploitation requires control over the job name/author fields and a remote user can trigger the attack by manipulating these inputs.","blast_radius":"If exploited, this could lead to data theft or manipulation of web pages viewed by other users, potentially compromising their sessions or sensitive information.","remediation":"Update xxl-job to version 3.5.1 or later which includes a fix for this vulnerability.","tags":["xss","web","input-validation"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:36:54.109Z"}}