Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
54 results · page 1 of 2
Sep 14, 2026novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to exCVE-2026-90941 · Other software · 201206030 · reported by VulnCheckMedium 5.3
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to CVE-2026-90940 · Other software · 201206030 · reported by VulnCheckMedium 6.9
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations.CVE-2026-90939 · Other software · 201206030 · reported by VulnCheckHigh 7.1
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint.CVE-2025-60299 · Other software · Xxyopen · reported by MITREMedium 5.4
Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user can inject malicious JavaScript through the replyContent parameter when replying to a book comment. The payload is stored in the database and is executed in other users’ browsers when they view the affected comment thread.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnotes.sjtu.edu.cn
Oct 8, 2025Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint.CVE-2025-60298 · Other software · Xxyopen · reported by MITREMedium 5.4
Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnotes.sjtu.edu.cn
Jun 23, 2025A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical.CVE-2025-6535 · Other software · xxyopen · reported by VulDBLow 2.1
A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/order leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.0xd00.comblog.0xd00.com
Jun 23, 2025A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3.CVE-2025-6534 · Other software · xxyopen · reported by VulDBLow 1.3
A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.0xd00.comblog.0xd00.com
Jun 23, 2025A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3.CVE-2025-6533 · Other software · xxyopen · reported by VulDBLow 2.9
A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation leads to authentication bypass by capture-replay. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.0xd00.comblog.0xd00.com
Jun 20, 2025Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameterCVE-2025-45890 · Other software · Xxyopen · reported by MITRECritical 9.8
Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.CVE-2025-4019 · Other software · 20120630 · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.CVE-2025-4018 · Other software · 20120630 · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlController.java. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.CVE-2025-4017 · Other software · 20120630 · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the function list of the file nnovel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.CVE-2025-4016 · Other software · 20120630 · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIndex of the file novel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.CVE-2025-4015 · Other software · 20120630 · reported by VulDBMedium 6.9
A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A vulnerability was found in xxyopen Novel-Plus 5.1.0.CVE-2025-3856 · Other software · xxyopen · reported by VulDBMedium 5.3
A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0.CVE-2025-3676 · Other software · xxyopen · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in xxyopen Novel-Plus 5.1.0.CVE-2025-3369 · Other software · xxyopen · reported by VulDBMedium 5.3
A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Novel-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java fileCVE-2025-26182 · Other software · Xxyopen · reported by MITREMedium 6.5
An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the fiCVE-2024-33383 · Other software · novel-plus · reported by MITREHigh 7.5
Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjuvl1ne.github.iojuvl1ne.github.io
Feb 20, 2024An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafCVE-2024-25274 · Other software · novel-plus · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comreference1.example.com
Feb 7, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.CVE-2024-24021 · Other software · Xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.CVE-2024-24017 · Other software · novel-plus · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.CVE-2024-24014 · Other software · Xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg().CVE-2024-24026 · Other software · Xxyopen · reported by MITRECritical 9.8
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload().CVE-2024-24025 · Other software · Xxyopen · reported by MITRECritical 9.8
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload().CVE-2024-24024 · Other software · xxyopen · reported by MITRECritical 9.8
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.CVE-2024-24023 · Other software · xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.CVE-2024-24018 · Other software · Xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.CVE-2024-24019 · Other software · Xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.CVE-2024-24015 · Other software · Xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.CVE-2024-24013 · Other software · Xxyopen · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical.CVE-2024-0941 · Other software · Xxyopen · reported by VulDBMedium 5.5
A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-252185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical.CVE-2024-0655 · Other software · Xxyopen · reported by VulDBMedium 5.5
A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251383.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023A vulnerability was found in Novel-Plus up to 4.2.0.CVE-2023-7171 · Other software · Xxyopen · reported by VulDBLow 2.4
A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d8182362422370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0.CVE-2023-7166 · Other software · Xxyopen · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2023SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/lCVE-2023-46981 · Other software · Xxyopen · reported by MITRECritical 9.8
SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/lisCVE-2023-41443 · Other software · Xxyopen · reported by MITREHigh 7.2
SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023novel-plus 3.6.2 is vulnerable to SQL Injection.CVE-2023-30058 · Other software · Xxyopen · reported by MITRECritical 9.8
novel-plus 3.6.2 is vulnerable to SQL Injection.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.CVE-2023-37847 · Other software · Xxyopen · reported by MITRECritical 9.8
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnovel.xxyopen.com
Apr 14, 2023A vulnerability classified as critical was found in novel-plus 3.6.2.CVE-2023-2041 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability classified as critical has been found in novel-plus 3.6.2.CVE-2023-2040 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability was found in novel-plus 3.6.2.CVE-2023-2039 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225917 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in novel-plus 3.6.2.CVE-2023-1607 · Other software · Xxyopen · reported by VulDBMedium 4.7
A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223737 was assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in novel-plus 3.6.2 and classified as critical.CVE-2023-1606 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability has been found in novel-plus 3.6.2 and classified as critical.CVE-2023-1595 · Other software · Xxyopen · reported by VulDBMedium 4.7
A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, was found in novel-plus 3.6.2.CVE-2023-1594 · Other software · Xxyopen · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.CVE-2022-36672 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.CVE-2022-36671 · Other software · Xxyopen · reported by MITREHigh 7.5
Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.CVE-2022-35121 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker toCVE-2021-42967 · Other software · Xxyopen · reported by MITRECritical 9.8
Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.