{"id":"CVE-2023-26120","aliases":[],"url":"https://o3.security/vulnerability/CVE-2023-26120","summary":"This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.","details":"This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.","published":"2023-04-10T05:15:07.003","modified":"2026-06-17T05:42:43.343","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[],"fix":null,"references":[{"type":"EXPLOIT","url":"https://security.snyk.io/vuln/SNYK-JAVA-COMXUXUELI-3248764"},{"type":"EXPLOIT","url":"https://security.snyk.io/vuln/SNYK-JAVA-COMXUXUELI-3248764"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-06-17T05:42:43.343"}}