CVE-2025-65442 | Medium | 6.1 | 2025-12-29 | DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive… |
CVE-2025-60299 | Medium | 5.4 | 2025-10-08 | Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user… |
CVE-2025-60298 | Medium | 5.4 | 2025-10-08 | Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability… |
CVE-2025-6535 | Medium | 6.3 | 2025-06-24 | A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file… |
CVE-2025-6534 | Medium | 4.2 | 2025-06-24 | A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel… |
CVE-2025-6533 | Medium | 5.6 | 2025-06-24 | A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin… |
CVE-2025-45890 | Critical | 9.8 | 2025-06-20 | Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter |
CVE-2025-4036 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/g… |
CVE-2025-4019 | High | 7.3 | 2025-04-28 | A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function ge… |
CVE-2025-4018 | Medium | 5.3 | 2025-04-28 | A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the… |
CVE-2025-4017 | Medium | 4.3 | 2025-04-28 | A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the funct… |
CVE-2025-4016 | Medium | 5.4 | 2025-04-28 | A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIn… |
CVE-2025-4015 | Medium | 5.3 | 2025-04-28 | A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-3956 | Medium | 6.3 | 2025-04-27 | A vulnerability has been found in 201206030 novel-cloud 1.4.0 and classified as critical. This vulnerability affects the function RestResp of the file novel-cl… |
CVE-2025-3856 | Medium | 6.3 | 2025-04-22 | A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPag… |
CVE-2025-3676 | Medium | 6.3 | 2025-04-16 | A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipu… |
CVE-2025-3369 | Medium | 6.3 | 2025-04-07 | A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/f… |
CVE-2025-26182 | Medium | 6.5 | 2025-03-04 | An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file |
CVE-2025-1154 | Medium | 6.3 | 2025-02-10 | A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-33383 | High | 7.5 | 2024-04-30 | Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the f… |
CVE-2024-25274 | Critical | 9.8 | 2024-02-20 | An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-24021 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform S… |
CVE-2024-24017 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-24014 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-24026 | Critical | 9.8 | 2024-02-08 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An a… |
CVE-2024-24025 | Critical | 9.8 | 2024-02-08 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pas… |
CVE-2024-24024 | Critical | 9.8 | 2024-02-08 | An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker… |
CVE-2024-24023 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform S… |
CVE-2024-24018 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-24019 | Critical | 9.8 | 2024-02-07 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-24015 | Critical | 9.8 | 2024-02-06 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-24013 | Critical | 9.8 | 2024-02-06 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-0941 | Medium | 5.5 | 2024-01-26 | A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. T… |
CVE-2024-0655 | Medium | 5.5 | 2024-01-18 | A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /nove… |
CVE-2023-7171 | Low | 2.4 | 2023-12-29 | A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2023-7166 | Low | 3.5 | 2023-12-29 | A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the compon… |
CVE-2023-46981 | Critical | 9.8 | 2023-11-05 | SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/… |
CVE-2023-41443 | High | 7.2 | 2023-09-18 | SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/li… |
CVE-2023-30058 | Critical | 9.8 | 2023-09-11 | novel-plus 3.6.2 is vulnerable to SQL Injection. |
CVE-2023-37847 | Critical | 9.8 | 2023-08-14 | novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability. |
CVE-2023-2041 | Medium | 6.3 | 2023-04-14 | A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?lim… |
CVE-2023-2040 | Medium | 6.3 | 2023-04-14 | A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc… |
CVE-2023-2039 | Medium | 6.3 | 2023-04-14 | A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offs… |
CVE-2023-1607 | Medium | 4.7 | 2023-03-23 | A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulat… |
CVE-2023-1606 | Medium | 6.3 | 2023-03-23 | A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java… |
CVE-2023-1595 | Medium | 4.7 | 2023-03-23 | A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/lo… |
CVE-2023-1594 | High | 7.3 | 2023-03-23 | A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulat… |
CVE-2022-36672 | Critical | 9.8 | 2022-09-01 | Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom use… |
CVE-2022-36671 | High | 7.5 | 2022-09-01 | Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API. |
CVE-2022-35121 | Critical | 9.8 | 2022-08-17 | Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. |
CVE-2021-42967 | Critical | 9.8 | 2022-05-13 | Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker t… |
CVE-2022-28462 | High | 7.5 | 2022-05-05 | novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability. |
CVE-2021-41921 | Critical | 9.8 | 2022-04-28 | novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution. |
CVE-2022-24568 | Critical | 9.8 | 2022-02-10 | Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. |