CVE-2026-3733
Last modified
CVE-2026-3733 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-3733?
How severe is CVE-2026-3733?
How do I fix CVE-2026-3733?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-3728A vulnerability was determined in Tenda F453 1.0.0.3/1.If. T…8.8
- CVE-2026-37281An OS command injection vulnerability in the /stream-to-vlc …9.8
- CVE-2026-3729A vulnerability was identified in Tenda F453 1.0.0.3/3.As. I…8.8
- CVE-2026-3730A security flaw has been discovered in itsourcecode Free Hot…9.8
- CVE-2026-3731A weakness has been identified in libssh up to 0.11.3. The i…7.5
- CVE-2026-3732A security vulnerability has been detected in Tenda F453 1.0…8.8
- CVE-2026-37336SourceCodester Simple Music Cloud Community System v1.0 is v…7.3
- CVE-2026-37337SourceCodester Simple Music Cloud Community System v1.0 is v…7.3
- CVE-2026-37338SourceCodester Simple Music Cloud Community System v1.0 is v…9.4
- CVE-2026-37339SourceCodester Simple Music Cloud Community System v1.0 is v…9.8
- CVE-2026-3734A flaw has been found in SourceCodester Client Database Mana…7.3
- CVE-2026-37340SourceCodester Simple Music Cloud Community System v1.0 is v…9.8
Are you affected by CVE-2026-3733?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST