Filtered by vendor Xxyopen
Subscribe
Total
32 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-24014 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 9.8 CRITICAL |
| A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list | |||||
| CVE-2024-24019 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 9.8 CRITICAL |
| A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list | |||||
| CVE-2023-41443 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 7.2 HIGH |
| SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list. | |||||
| CVE-2023-30058 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 9.8 CRITICAL |
| novel-plus 3.6.2 is vulnerable to SQL Injection. | |||||
| CVE-2023-46981 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list. | |||||
| CVE-2022-36671 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 7.5 HIGH |
| Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API. | |||||
| CVE-2022-35121 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 9.8 CRITICAL |
| Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. | |||||
| CVE-2022-36672 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | N/A | 9.8 CRITICAL |
| Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session. | |||||
| CVE-2022-28462 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability. | |||||
| CVE-2021-42967 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files. | |||||
| CVE-2022-24568 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. | |||||
| CVE-2021-41921 | 1 Xxyopen | 1 Novel-plus | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution. | |||||