CVE-2025-9264

low-risk
Published 2025-08-21

A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Xuxueli

References (6)

Exploit https://github.com/xuxueli/xxl-job/issues/3773
Exploit https://github.com/xuxueli/xxl-job/issues/3773#issue-3308389841
Permissions Required https://vuldb.com/?ctiid.320806
Third Party Advisory https://vuldb.com/?id.320806
Third Party Advisory https://vuldb.com/?submit.631728
Exploit https://github.com/xuxueli/xxl-job/issues/3773
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal