Vulnerability in 201206030 Novel-Plus
CVE-2026-90940
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.005 (45.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 45.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/201206030/novel-plus (product)
- github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/n… (technical-description)
- github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/n… (technical-description)
- github.com/201206030/novel-plus/releases/tag/v5.3.3 (release-notes)
- github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-07-front-cache… (exploit)
- www.vulncheck.com/advisories/novel-plus-through-5.3.3-default-cache-management-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-90940?
- CVE-2026-90940 is a medium-severity vulnerability in 201206030 Novel-Plus, classified under CWE-1392. CVSS score: 5.3/10. Published 2026-09-14.
- How severe is CVE-2026-90940?
- Medium severity. CVSS v3 base score is 5.3 out of 10.