Powerjob
Monthly
Remote code execution in PowerJob Server 5.1.2 (and likely earlier releases) stems from a predictable/hardcoded HS256 signing key used for the server's JWT authentication, letting an unauthenticated remote attacker forge valid admin session tokens and drive PowerJob's job-execution features to run arbitrary code. PowerJob is an open-source distributed task-scheduling framework, and because the secret is derived by a default provider rather than randomly generated, any exposed instance is trivially impersonatable. Publicly available exploit code exists (a proof-of-concept gist), though there is no CISA KEV listing or confirmed in-the-wild exploitation at time of analysis.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 lets any actor that can reach the server's Server-Worker transport port send crafted messages to the /friend/process endpoint and execute arbitrary code in the PowerJob process context; the assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the root cause class is CWE-287 improper authentication. Publicly available exploit code exists (a PoC repository and a gist are linked from the CVE record), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is 0.62% (47th percentile), notably low relative to the 9.8 severity because exploitation is gated by network exposure rather than by any authentication or user-interaction prerequisite. Realistic risk therefore concentrates on flat networks, cloud deployments that publish the transport port (including default docker-compose setups), and post-perimeter attackers, while well-segmented deployments that keep worker communication internal are substantially less exposed.
Remote code injection in PowerJob 5.1.0, 5.1.1, and 5.1.2 allows unauthenticated attackers to execute arbitrary code via the GroovyEvaluator.evaluate function in the OpenAPI endpoint /openApi/addWorkflowNode by manipulating the nodeParams argument. The vulnerability exploits unsafe Groovy code evaluation without input sanitization, enabling full remote code execution with a low CVSS complexity score (6.9/10). No public exploit code is confirmed at time of analysis, and the vendor has not yet responded to the early disclosure notification.
Server-side request forgery in PowerJob up to version 5.1.2 allows authenticated remote attackers to manipulate the targetIp and targetPort arguments in the checkConnectivity function of the Network Request Handler component, enabling SSRF attacks with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite the public exploit availability, suggesting this vulnerability has seen limited active abuse.
Missing authorization in PowerJob through 5.1.2 lets unauthenticated remote attackers who can reach the OpenAPI service invoke the /openApi/runJob endpoint without credentials, potentially triggering job execution with limited confidentiality and integrity impact. This is a moderate-severity CWE-862 flaw rather than a top-tier emergency; publicly available exploit code exists, and EPSS is low at 0.46% (38th percentile).
Missing authorization in PowerJob through 5.1.2 exposes the /user/list endpoint, allowing remote unauthenticated attackers to retrieve the application's user list and disclose account-related information. The impact is limited to confidentiality, with no write or availability effect, and publicly available exploit code exists. EPSS is 1.09% (65th percentile), indicating low absolute likelihood; the issue is not reported as actively exploited in CISA KEV.
Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerJob V4.3.2 has unauthorized interface that causes remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PowerJob V4.3.1 is vulnerable to Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in PowerJob Server 5.1.2 (and likely earlier releases) stems from a predictable/hardcoded HS256 signing key used for the server's JWT authentication, letting an unauthenticated remote attacker forge valid admin session tokens and drive PowerJob's job-execution features to run arbitrary code. PowerJob is an open-source distributed task-scheduling framework, and because the secret is derived by a default provider rather than randomly generated, any exposed instance is trivially impersonatable. Publicly available exploit code exists (a proof-of-concept gist), though there is no CISA KEV listing or confirmed in-the-wild exploitation at time of analysis.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 lets any actor that can reach the server's Server-Worker transport port send crafted messages to the /friend/process endpoint and execute arbitrary code in the PowerJob process context; the assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the root cause class is CWE-287 improper authentication. Publicly available exploit code exists (a PoC repository and a gist are linked from the CVE record), but the CVE is not listed in CISA KEV, so active exploitation is not confirmed; EPSS is 0.62% (47th percentile), notably low relative to the 9.8 severity because exploitation is gated by network exposure rather than by any authentication or user-interaction prerequisite. Realistic risk therefore concentrates on flat networks, cloud deployments that publish the transport port (including default docker-compose setups), and post-perimeter attackers, while well-segmented deployments that keep worker communication internal are substantially less exposed.
Remote code injection in PowerJob 5.1.0, 5.1.1, and 5.1.2 allows unauthenticated attackers to execute arbitrary code via the GroovyEvaluator.evaluate function in the OpenAPI endpoint /openApi/addWorkflowNode by manipulating the nodeParams argument. The vulnerability exploits unsafe Groovy code evaluation without input sanitization, enabling full remote code execution with a low CVSS complexity score (6.9/10). No public exploit code is confirmed at time of analysis, and the vendor has not yet responded to the early disclosure notification.
Server-side request forgery in PowerJob up to version 5.1.2 allows authenticated remote attackers to manipulate the targetIp and targetPort arguments in the checkConnectivity function of the Network Request Handler component, enabling SSRF attacks with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite the public exploit availability, suggesting this vulnerability has seen limited active abuse.
Missing authorization in PowerJob through 5.1.2 lets unauthenticated remote attackers who can reach the OpenAPI service invoke the /openApi/runJob endpoint without credentials, potentially triggering job execution with limited confidentiality and integrity impact. This is a moderate-severity CWE-862 flaw rather than a top-tier emergency; publicly available exploit code exists, and EPSS is low at 0.46% (38th percentile).
Missing authorization in PowerJob through 5.1.2 exposes the /user/list endpoint, allowing remote unauthenticated attackers to retrieve the application's user list and disclose account-related information. The impact is limited to confidentiality, with no write or availability effect, and publicly available exploit code exists. EPSS is 1.09% (65th percentile), indicating low absolute likelihood; the issue is not reported as actively exploited in CISA KEV.
Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerJob V4.3.2 has unauthorized interface that causes remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PowerJob V4.3.1 is vulnerable to Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.