Xxl Sso
Monthly
Open redirect vulnerability in Xuxueli xxl-sso 1.1.0 allows authenticated remote attackers to redirect users to arbitrary websites via the redirect_url parameter of the /xxl-sso-server/doLogin endpoint. Exploit code is publicly available, but no active exploitation has been reported (not in CISA KEV). EPSS indicates very low likelihood of widespread exploitation (0.05%).
Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.
Open redirect vulnerability in Xuxueli xxl-sso 1.1.0 allows authenticated remote attackers to redirect users to arbitrary websites via the redirect_url parameter of the /xxl-sso-server/doLogin endpoint. Exploit code is publicly available, but no active exploitation has been reported (not in CISA KEV). EPSS indicates very low likelihood of widespread exploitation (0.05%).
Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.