tech.powerjob vulnerabilities

Products

• tech.powerjob/powerjob 7
• tech.powerjob/powerjob-server-starter 3
• tech.powerjob/powerjob-common 2

Latest tech.powerjob CVEs

Newest publication first

1. CVE-2026-5739 PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection

   Published 2026-04-07

   Medium·CVSS 6.9 EPSS 0.40%

   A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The atta...

2. CVE-2026-5736 PowerJob detailPlus Endpoint InstanceController.java sql injection

   Published 2026-04-07

   Medium·CVSS 6.9 EPSS 0.27%

   A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of th...

3. CVE-2025-14518 PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery

   Published 2025-12-11

   Medium·CVSS 5.3 EPSS 0.38%

   A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/target...

4. CVE-2025-11581 PowerJob OpenAPIController runJob authorization

   Published 2025-10-10

   Medium·CVSS 6.9 EPSS 0.46%

   A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAPIController. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been...

5. CVE-2025-11580 PowerJob list authorization

   Published 2025-10-10

   Medium·CVSS 6.9 EPSS 1.1%

   A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

6. CVE-2023-36106 PowerJob incorrect access control vulnerability

   Published 2023-08-17

   High·CVSS 7.5 EPSS 0.91%

   An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.

7. CVE-2023-37754 Code injection in PowerJob

   Published 2023-07-28

   Critical·CVSS 9.8 EPSS 30.0%

   PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.

8. CVE-2023-29924 PowerJob vulnerable to incorrect access control

   Published 2023-04-21

   Critical·CVSS 9.8 EPSS 1.1%

   PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.

9. CVE-2023-29926 PowerJob vulnerable to remote code execution

   Published 2023-04-20

   Critical·CVSS 9.8 EPSS 1.2%

   PowerJob V4.3.2 has unauthorized interface that causes remote code execution.

10. CVE-2023-29921 PowerJob Incorrect Access Control vulnerability

    Published 2023-04-19

    Medium·CVSS 5.3 EPSS 0.53%

    PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.

11. CVE-2023-29922 PowerJob vulnerable to Incorrect Access Control via the create user/save interface.

    Published 2023-04-19

    Medium·CVSS 5.3 EPSS 3.0%

    PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.

12. CVE-2023-29923 PowerJob vulnerable to Insecure Permissions

    Published 2023-04-19

    Medium·CVSS 5.3 EPSS 9.5%

    PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.