CVE-2025-9264
medium
CVSS v3
5.4
CVSS v2
5.5
VIR risk
5.4
Description
xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter
Predictions
Exploit likelihood
64%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cna@vuldb.com — https://github.com/xuxueli/xxl-job/issues/3773#issue-3308389841
Vendor advisory: cna@vuldb.com — https://github.com/xuxueli/xxl-job/issues/3773
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | com.xuxueli:xxl-job-admin | <3.2.0 | 3.2.0 |
| MAVEN | com.xuxueli:xxl-job-admin | <= 3.1.1 | 3.2.0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| xuxueli | xxl-job | {"endIncluding":"3.1.1"} | |
References
- https://github.com/xuxueli/xxl-job/issues/3773
- https://github.com/xuxueli/xxl-job/issues/3773#issue-3308389841
- https://vuldb.com/?ctiid.320806
- https://vuldb.com/?id.320806
- https://vuldb.com/?submit.631728
- https://nvd.nist.gov/vuln/detail/CVE-2025-9264
- https://github.com/xuxueli/xxl-job
- https://github.com/advisories/GHSA-gjx6-h8hm-c9rq
CWEs
CWE-99 CWE-639
Verify integrity in audit chain (admin only). AS-IS.