Threats affecting pkg:github/xuxueli/xxl-api

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.1	EPSS 0.2%	CVE-2025-60646xxl-api · Cross-site Scripting Medium6.1EPSS 0.2%2025-11-12CVE Database V5CVE-2025-60646 A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-11-12
Medium	6.5	EPSS 0.2%	CVE-2025-60645xxl-api · Cross-Site Request Forgery (CSRF) Medium6.5EPSS 0.2%2025-11-12CVE Database V5CVE-2025-60645 A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2025-11-12

Page 1 of 1