Priority MEDIUM 58
Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00219 · Published 2025-10-08 · No fix listed CWE-79
Priority MEDIUM 58
Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0027 · Published 2025-10-08 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00485 · Published 2025-06-24 · No fix listed CWE-74
Priority MEDIUM 45
A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.0048 · Published 2025-06-24 · No fix listed CWE-99
Priority MEDIUM 61
A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00558 · Published 2025-06-24 · No fix listed CWE-287
Priority HIGH 82
Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01558 · Published 2025-06-20 · No fix listed CWE-22
Priority HIGH 70
A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00704 · Published 2025-04-28 · No fix listed CWE-287
Priority LOW 38
A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00834 · Published 2025-04-28 · No fix listed CWE-287
Priority LOW 25
A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00563 · Published 2025-04-28 · No fix listed CWE-266
Priority LOW 25
A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00505 · Published 2025-04-28 · No fix listed CWE-266
Priority LOW 38
A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0083 · Published 2025-04-28 · No fix listed CWE-287
Priority LOW 25
A vulnerability was found in xxyopen Novel-Plus 5.1.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00596 · Published 2025-04-22 · No fix listed CWE-74
Priority MEDIUM 57
A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00557 · Published 2025-04-16 · No fix listed CWE-74
Priority MEDIUM 57
A vulnerability was found in xxyopen Novel-Plus 5.1.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0058 · Published 2025-04-07 · No fix listed CWE-74
Priority LOW 31
An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00488 · Published 2025-03-04 · No fix listed CWE-94
Priority HIGH 72
Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0067 · Published 2024-04-30 · No fix listed CWE-639
Priority MEDIUM 50
An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00783 · Published 2024-02-20 · No fix listed CWE-434
Priority MEDIUM 43
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00694 · Published 2024-02-08 · No fix listed CWE-434
Priority MEDIUM 43
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00654 · Published 2024-02-08 · No fix listed CWE-434
Priority MEDIUM 50
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00654 · Published 2024-02-08 · No fix listed CWE-434
Priority MEDIUM 50
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00622 · Published 2024-02-08 · No fix listed CWE-89
Priority MEDIUM 43
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00622 · Published 2024-02-08 · No fix listed CWE-89
Priority MEDIUM 50
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00609 · Published 2024-02-08 · No fix listed CWE-89
Priority MEDIUM 49
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00627 · Published 2024-02-08 · No fix listed CWE-89
Priority MEDIUM 50
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00622 · Published 2024-02-08 · No fix listed CWE-89
Load more
THREATIST.IORead the docs