CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-26182

CVE-2025-26182 affects xxyopen novel plus prior to 4.4.0. The vulnerability allows a remote attacker to execute arbitrary code via the PageController.java file. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N with base score 6.5 (MEDIUM). Connected sources corroborate the issue and men...

PT-2025-9684 · Unknown · Xxyopen Novel-Plus

Name of the Vulnerable Software and Affected Versions: xxyopen novel plus versions prior to 4.4.0 Description: The issue allows a remote attacker to execute arbitrary code via the PageController.java file. Recommendations: For versions prior to 4.4.0, update to a version that contains a fix for...

CVE-2024-33383

Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter...

CVE-2024-33383

Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter...

novel-plus 安全漏洞

novel-plus 小说精品屋-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus version 4.3.0 and earlier, which stems from an arbitrary file read vulnerability that allows remote attackers to obtain sensitive information via a...

PT-2024-25226 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus versions 4.3.0 and earlier Description: The issue allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter. This enables the attacker to read arbitrary files, potentially leadi...

CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

Privilege escalation

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

Novel-Plus Security Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A security vulnerability exists in Novel-Plus version v4.3.0-RC1, which stems from allowing the upload of arbitrary files. An attacker could exploit the vulnerability to execute arbitrary code by uploading specially...

CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-25274

CVE-2024-25274 affects Novel-Plus v4.3.0-RC1, with an arbitrary file upload vulnerability in the /sysFile/upload component that allows an attacker to execute arbitrary code. Public documentation consistently cites a crafted file upload as the exploit vector, underscoring impact on confidentiality...

CVE-2024-25274

An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file...

PT-2024-20854 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 4.3.0-RC1 Description: The issue is related to an arbitrary file upload vulnerability in the component /sysFile/upload. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

Novel-Plus Arbitrary File Upload Vulnerability

Novel-Plus is a multi-end PC, WAP reading, fully functional novel CMS system. Novel-Plus com.java2nb.common.controller.FileController: upload processing fieName parameter there is an arbitrary file upload vulnerability, a remote attacker can use the vulnerability to submit a special request, you...

CVE-2024-24014

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list...

CVE-2024-24021

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list...