Description
A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.
Medium · 6.5
CVE-2025-60645
EUVD-2025-131959GHSA-wjh9-7v88-c76j
A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET …
Published Nov 12, 2025 · Updated Nov 13, 2025 · Assigned by mitre