Novel Plus
by Xxyopen
Source repositories
CVEs (50)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-45890 | Cri | 0.64 | 9.8 | 0.01 | Jun 20, 2025 | Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter | ||
| CVE-2024-25274 | Cri | 0.64 | 9.8 | 0.01 | Feb 20, 2024 | An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file. | ||
| CVE-2024-24021 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list. | ||
| CVE-2024-24017 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list | ||
| CVE-2024-24014 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list | ||
| CVE-2024-24026 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download. | ||
| CVE-2024-24025 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download. | ||
| CVE-2024-24024 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download. | ||
| CVE-2024-24023 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list. | ||
| CVE-2024-24018 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list | ||
| CVE-2024-24019 | Cri | 0.64 | 9.8 | 0.01 | Feb 7, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list | ||
| CVE-2024-24015 | Cri | 0.64 | 9.8 | 0.01 | Feb 6, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit | ||
| CVE-2024-24013 | Cri | 0.64 | 9.8 | 0.01 | Feb 6, 2024 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list | ||
| CVE-2023-46981 | Cri | 0.64 | 9.8 | 0.01 | Nov 5, 2023 | SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list. | ||
| CVE-2023-30058 | Cri | 0.64 | 9.8 | 0.01 | Sep 11, 2023 | novel-plus 3.6.2 is vulnerable to SQL Injection. | ||
| CVE-2023-37847 | Cri | 0.64 | 9.8 | 0.01 | Aug 14, 2023 | novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability. | ||
| CVE-2022-36672 | Cri | 0.64 | 9.8 | 0.01 | Sep 1, 2022 | Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session. | ||
| CVE-2022-35121 | Cri | 0.64 | 9.8 | 0.01 | Aug 17, 2022 | Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. | ||
| CVE-2021-42967 | Cri | 0.64 | 9.8 | 0.01 | May 13, 2022 | Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files. | ||
| CVE-2021-41921 | Cri | 0.64 | 9.8 | 0.02 | Apr 28, 2022 | novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution. |
- risk 0.64cvss 9.8epss 0.01
Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list.
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list
- risk 0.64cvss 9.8epss 0.01
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
- risk 0.64cvss 9.8epss 0.01
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
- risk 0.64cvss 9.8epss 0.01
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download.
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit
- risk 0.64cvss 9.8epss 0.01
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.
- risk 0.64cvss 9.8epss 0.01
novel-plus 3.6.2 is vulnerable to SQL Injection.
- risk 0.64cvss 9.8epss 0.01
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
- risk 0.64cvss 9.8epss 0.01
Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.
- risk 0.64cvss 9.8epss 0.01
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
- risk 0.64cvss 9.8epss 0.01
Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.
- risk 0.64cvss 9.8epss 0.02
novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution.
Page 1 of 3