CVE-2026-7303— Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7303
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对资源描述符的控制不恰当(资源注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
XXL-JOB 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XXL-JOB是许雪里（xuxueli）个人开发者的一个分布式任务调度平台。 XXL-JOB 3.3.2及之前版本存在安全漏洞，该漏洞源于组件Execution Log Handler中文件xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java的函数logDetailCat的参数logId操作导致资源标识符控制不当，可能允许远程攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-7303
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7303
请登录查看更多情报信息。
Same Patch Batch · Xuxueli · 2026-04-28 · 3 CVEs total
| CVE-2026-7305 | 6.3 MEDIUM | Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request for |
| CVE-2026-7306 | 5.6 MEDIUM | Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key |
IV. Related Vulnerabilities
Same product: xxl-job
- CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard - CVE-2026-7305
Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java trig - CVE-2026-3733
xuxueli xxl-job JobInfoController.java server-side request f - CVE-2025-9264
Xuxueli xxl-job Jobs JobInfoController.java remove resource - CVE-2025-9263
Xuxueli xxl-job JobLogController.java getJobsByGroup resourc
Same vendor: Xuxueli
- CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard - CVE-2026-7305
Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java trig - CVE-2026-3733
xuxueli xxl-job JobInfoController.java server-side request f - CVE-2025-9264
Xuxueli xxl-job Jobs JobInfoController.java remove resource - CVE-2025-9263
Xuxueli xxl-job JobLogController.java getJobsByGroup resourc
Same weakness: CWE-99
- CVE-2026-5414
Newgen OmniDocs WebApiRequestRedirection resource injection - CVE-2026-5031
BichitroGan ISP Billing Software Endpoint users-view resourc - CVE-2026-3693
Shy2593666979 AgentChat User Endpoint user.py update_user_in - CVE-2025-12919
EverShop Order Order.resolvers.js resource injection - CVE-2025-12918
yungifez Skuul School Management System View Fee Invoice fee
V. Comments for CVE-2026-7303
No comments yet