CVE-2026-94145

3.5 LOWpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: A cross-site scripting vulnerability exists in xxl-job versions up to 3.4.2/3.5.0 due to improper input handling, allowing attackers to inject malicious scripts via job names or authors.
Exploitability: Exploitation requires control over the job name/author fields and a remote user can trigger the attack by manipulating these inputs.
Blast radius: If exploited, this could lead to data theft or manipulation of web pages viewed by other users, potentially compromising their sessions or sensitive information.
Prioritized remediation: Update xxl-job to version 3.5.1 or later which includes a fix for this vulnerability.

xsswebinput-validation

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses

CWE-79, CWE-94

Public exploit & PoC references

https://github.com/hhhh333/CVE/blob/main/xxl-job-xss%202.md

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.