Novel-plus vulnerabilities
17 known vulnerabilities in Novel-plus from Xxyopen. 17 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module
- 9.8 Critical severity
Novel-Plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attac
- 9.8 Critical severity
Novel-Plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. T
- 9.8 Critical severity
Novel-Plus: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launc
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list.
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list
- 9.8 Critical severity
Novel-plus: Unrestricted Upload of File with Dangerous Type
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
- 9.8 Critical severity
Novel-plus: Unrestricted Upload of File with Dangerous Type
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.
- 9.8 Critical severity
novel-plus: Unrestricted Upload of File with Dangerous Type
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File download.
- 9.8 Critical severity
novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list
- 9.8 Critical severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.
- 7.2 High severity
Novel-plus: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list.
- 9.8 Critical severity
Novel-plus: Use of Hard-coded Credentials
Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.