CVE-2025-60645

Published November 12th, 2025

View on NVD ↗

CVSS v3

6.5

MEDIUM

CVSS v2

N/A

Affected

1

PROJECT

Description

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

xuxueli/xxl-api

A api management platform.（API管理平台XXL-API）

GitHub

954