CVE-2025-9263
medium
CVSS v3
4.3
CVSS v2
4.0
VIR risk
4.3
Description
xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key
Predictions
Exploit likelihood
53%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cna@vuldb.com — https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205
Vendor advisory: cna@vuldb.com — https://github.com/xuxueli/xxl-job/issues/3772
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | com.xuxueli:xxl-job-admin | <3.2.0 | 3.2.0 |
| MAVEN | com.xuxueli:xxl-job-admin | <= 3.1.1 | 3.2.0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| xuxueli | xxl-job | {"endIncluding":"3.1.1"} | |
References
- https://github.com/xuxueli/xxl-job/issues/3772
- https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205
- https://vuldb.com/?ctiid.320805
- https://vuldb.com/?id.320805
- https://vuldb.com/?submit.631704
- https://nvd.nist.gov/vuln/detail/CVE-2025-9263
- https://github.com/xuxueli/xxl-job
- https://github.com/advisories/GHSA-6rq7-m52p-8pqg
CWEs
CWE-99 CWE-639
Verify integrity in audit chain (admin only). AS-IS.