Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-7303
PUBLISHED
More InfoOfficial Page
Assigner-VulDB
Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5
View Known Exploited Vulnerability (KEV) details
Published At-28 Apr, 2026 | 19:00
Updated At-29 Apr, 2026 | 13:11
Rejected At-
▼CVE Numbering Authority (CNA)
Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component.

Affected Products
Vendor
Xuxueli
Product
xxl-job
CPEs
  • cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*
Modules
  • Execution Log Handler
Versions
Affected
  • 3.3.0
  • 3.3.1
  • 3.3.2
Unaffected
  • 3.4.0
Problem Types
TypeCWE IDDescription
CWECWE-99Improper Control of Resource Identifiers
Type: CWE
CWE ID: CWE-99
Description: Improper Control of Resource Identifiers
Metrics
VersionBase scoreBase severityVector
4.06.3MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
3.13.7LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
3.03.7LOW
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
2.02.6N/A
AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C
Version: 4.0
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Version: 3.1
Base score: 3.7
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Version: 3.0
Base score: 3.7
Base severity: LOW
Vector:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Version: 2.0
Base score: 2.6
Base severity: N/A
Vector:
AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
larlarua (VulDB User)
Timeline
EventDate
Advisory disclosed2026-04-28 00:00:00
VulDB entry created2026-04-28 02:00:00
VulDB entry last update2026-04-28 13:50:22
Event: Advisory disclosed
Date: 2026-04-28 00:00:00
Event: VulDB entry created
Date: 2026-04-28 02:00:00
Event: VulDB entry last update
Date: 2026-04-28 13:50:22
Replaced By
Rejected Reason
References
HyperlinkResource
https://vuldb.com/vuln/359959
vdb-entry
technical-description
https://vuldb.com/vuln/359959/cti
signature
permissions-required
https://vuldb.com/submit/803075
third-party-advisory
https://github.com/xuxueli/xxl-job/issues/3936
exploit
issue-tracking
https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a
patch
https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0
patch
https://github.com/xuxueli/xxl-job/
product
Hyperlink: https://vuldb.com/vuln/359959
Resource:
vdb-entry
technical-description
Hyperlink: https://vuldb.com/vuln/359959/cti
Resource:
signature
permissions-required
Hyperlink: https://vuldb.com/submit/803075
Resource:
third-party-advisory
Hyperlink: https://github.com/xuxueli/xxl-job/issues/3936
Resource:
exploit
issue-tracking
Hyperlink: https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a
Resource:
patch
Hyperlink: https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0
Resource:
patch
Hyperlink: https://github.com/xuxueli/xxl-job/
Resource:
product
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found