Xuxueli Xxl-api vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Xuxueli Xxl-api: 2 record(s), with affected versions and fixes.
cpe:2.3:a:xuxueli:xxl-api

CVE-2025-60646 Medium · 6.1 CWE-79 Nov 12, 2025

Cross-site Scripting (XSS) in Xuxueli Xxl-api

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

CVE-2025-60645 Medium · 6.5 CWE-352 Nov 12, 2025

Cross-Site Request Forgery (CSRF) in Xuxueli Xxl-api

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.