CVE-2023-7166 Novel-Plus HTTP POST Request updateUserInfo cross site scripting

🗓️ 29 Dec 2023 08:31:04Reported by GoogleType

osv🔗 osv.dev👁 18 Views

Vulnerability in Novel-Plus software v4.2.0 allows remote attackers to trigger cross-site scripting via manipulation of the nickName argument in the HTTP POST Request Handler component. Patch with identifier c62da9bb3a9b3603014d0edb436146512631100d is available.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2023-7166	29 Dec 202310:26	–	circl
CNNVD	Novel-Plus Cross-Site Scripting Vulnerability	29 Dec 202300:00	–	cnnvd
CVE	CVE-2023-7166	29 Dec 202308:31	–	cve
Cvelist	CVE-2023-7166 Novel-Plus HTTP POST Request updateUserInfo cross site scripting	29 Dec 202308:31	–	cvelist
EUVD	EUVD-2023-59347	3 Oct 202520:07	–	euvd
NVD	CVE-2023-7166	29 Dec 202309:15	–	nvd
Prion	Cross site scripting	29 Dec 202309:15	–	prion
Positive Technologies	PT-2023-32917 · Unknown · Novel-Plus	29 Dec 202300:00	–	ptsecurity

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7166.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-7166
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/201206030/novel-plus/commit/c62da9bb3a9b3603014d0edb436146512631100d
github	www.github.com/JTZ-a/SRC/blob/master/novel-plus/storedXSS/en-us.md

15 Jul 2026 02:10Current

3.8Low risk

Vulners AI Score3.8

CVSS 3.13.5

EPSS0.00545