Unrated severityNVD Advisory· Published Nov 12, 2025· Updated Nov 13, 2025
CVE-2025-60645
CVE-2025-60645
Description
A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.
Affected products
2- xxl-api/xxl-apidescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.