CVE-2025-9263

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-99 CWE-639

Affected software

Vendor	Product	Versions
Xuxueli	xxl-job	3.1.0; 3.1.1

References

https://github.com/xuxueli/xxl-job/issues/3772Exploit, Issue Tracking, Vendor Advisory
https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.320805Permissions Required, VDB Entry
https://vuldb.com/?id.320805Third Party Advisory, VDB Entry
https://vuldb.com/?submit.631704Third Party Advisory, VDB Entry
https://github.com/xuxueli/xxl-job/issues/3772Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Aug 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-92645.4A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/j CVE-2025-926510.0A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving th CVE-2025-92664.3The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scrip CVE-2025-92677.0In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from CVE-2025-92696.9A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerabi CVE-2025-92734.3CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensiti CVE-2025-92747.8Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remot CVE-2025-92757.8Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote CVE-2025-92769.8Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote att CVE-2025-92776.4The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all CVE-2025-92787.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the CVE-2025-92797.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP