Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Novel\-Plus
(Xxyopen)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 32 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2023-11-05 | CVE-2023-46981 | SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list. | Novel\-Plus | 9.8 | ||
2023-09-11 | CVE-2023-30058 | novel-plus 3.6.2 is vulnerable to SQL Injection. | Novel\-Plus | 9.8 | ||
2023-09-18 | CVE-2023-41443 | SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list. | Novel\-Plus | 7.2 | ||
2022-02-10 | CVE-2022-24568 | Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. | Novel\-Plus | 9.8 | ||
2022-04-28 | CVE-2021-41921 | novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution. | Novel\-Plus | 9.8 | ||
2022-05-05 | CVE-2022-28462 | novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability. | Novel\-Plus | 7.5 | ||
2022-05-13 | CVE-2021-42967 | Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files. | Novel\-Plus | 9.8 | ||
2022-08-17 | CVE-2022-35121 | Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. | Novel\-Plus | 9.8 | ||
2022-09-01 | CVE-2022-36671 | Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API. | Novel\-Plus | 7.5 | ||
2022-09-01 | CVE-2022-36672 | Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session. | Novel\-Plus | 9.8 |