CVE-2025-60646

MediumCVSS 6.1

Published: 12/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Risk Assessment

An attacker could execute malicious code in a user's browser, potentially leading to session theft or content modification.

Recommendation

Apply the vendor fix or properly validate and encode input in the Name parameter.

Other vulnerabilities in Xxl-api

CVE-2025-60645Medium
A Cross-Site Request Forgery (CSRF) vulnerability in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

Original NVD description (English source)

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS