Product:

Novel\-Plus

(Xxyopen)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 32
Date Id Summary Products Score Patch Annotated
2024-02-08 CVE-2024-24014 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list Novel\-Plus 9.8
2024-02-08 CVE-2024-24021 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list. Novel\-Plus 9.8
2023-11-05 CVE-2023-46981 SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list. Novel\-Plus 9.8
2023-09-11 CVE-2023-30058 novel-plus 3.6.2 is vulnerable to SQL Injection. Novel\-Plus 9.8
2023-09-18 CVE-2023-41443 SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list. Novel\-Plus 7.2
2022-02-10 CVE-2022-24568 Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. Novel\-Plus 9.8
2022-04-28 CVE-2021-41921 novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution. Novel\-Plus 9.8
2022-05-05 CVE-2022-28462 novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability. Novel\-Plus 7.5
2022-05-13 CVE-2021-42967 Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files. Novel\-Plus 9.8
2022-08-17 CVE-2022-35121 Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. Novel\-Plus 9.8