Novel-plus vulnerabilities
We track 12 vulnerabilities in Novel-plus products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on April 30, 2024.
Latest Novel-plus vulnerabilities
- 7.5 High severity
novel-plus: Authorization Bypass Through User-Controlled Key
Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter.
- 9.8 Critical severity
novel-plus: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.
- 9.8 Critical severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list
- 9.8 Critical severity
Novel-Plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the pu
- 9.8 Critical severity
Novel-Plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has bee
- 8.8 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack c
- 8.8 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack re
- 8.8 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack may be init
- 8.8 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The
- 9.8 Critical severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely
- 7.2 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remo
- 9.8 Critical severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The ex