CVE-2022-29002: Xuxueli Xxl-Job

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.

Affected products

• Xuxueli Xxl-Job: version 2.3.0 only

Published 2022-05-23. Last modified 2026-06-17.