Medium severity5.4NVD Advisory· Published Oct 15, 2026· Updated Oct 15, 2026

CVE-2026-106707

Description

XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.

Affected products

Xuxueli/Xxl Jobreferences
Xxl Job/xxl-job-adminllm-fuzzy
Range: <=3.5.0-SNAPSHOT

Patches

Vulnerability mechanics

References

github.com/tao0845/CVE-Request/blob/main/CVE-2026-106707.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000