PT-2025-34169 · Xxl-Job · Xxl-Job

Ez-Lbz · Published 2025-08-20 · Updated 2025-08-21 · CVE-2025-9264

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-job versions up to 3.1.1

Description: A vulnerability exists in Xuxueli xxl-job. The issue affects the remove function within the /src/main/java/com/xxl/job/admin/controller/JobInfoController.java file of the Jobs Handler component. Manipulation of the ID argument leads to improper control of resource identifiers, potentially allowing for remote exploitation. The exploit for this issue has been publicly released.

Recommendations: Versions prior to 3.1.1 are affected.

Exploit

Fix

RCE

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

CVE-2025-9264

GHSA-GJX6-H8HM-C9RQ

Affected Products

Xxl-Job

References · 12

• 🔥 https://github.com/xuxueli/xxl-job/issues/3773#issue-3308389841 · Exploit
• 🔥 https://github.com/xuxueli/xxl-job/issues/3773 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9264 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gjx6-h8hm-c9rq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9264 · Security Note
• https://github.com/xuxueli/xxl-job · Note
• https://vuldb.com/?id.320806 · Note
• https://vuldb.com/?submit.631728 · Note
• https://t.me/cveNotify/132966 · Telegram Post
• https://twitter.com/CVEnew/status/1958397780197577199 · Twitter Post
• https://vuldb.com/?ctiid.320806 · Note
• https://t.me/CVEtracker/30541 · Telegram Post