PT-2025-46685 · Xxl-Api · Xxl-Api

Published 2025-11-12 · Updated 2025-12-04 · CVE-2025-60645

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions xxl-api version 1.3.0

Description A Cross-Site Request Forgery (CSRF) exists in xxl-api version 1.3.0. This allows attackers to add users to the management module by sending a specially crafted GET request. The attack leverages a lack of proper CSRF protection. The API endpoint used in the attack is not specified. The vulnerable parameter is not specified. The function involved in the attack is not specified.

Recommendations Apply updates to address the issue in xxl-api version 1.3.0. As a temporary workaround, consider implementing CSRF protection mechanisms, such as synchronizer tokens, to mitigate the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-60645

Affected Products

Xxl-Api

References · 8

• 🔥 https://gist.github.com/LockeTom/77fb982a49dee956101810bbefa09fb4 · Exploit
• https://github.com/xuxueli/xxl-api/issues/64 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60645 · Security Note
• https://t.me/CVEtracker/37161 · Telegram Post
• https://twitter.com/dailycve/status/1996373829262918040 · Twitter Post
• https://t.me/cveNotify/144685 · Telegram Post
• https://twitter.com/CVEnew/status/1988721792752447785 · Twitter Post