CVE-2026-110104

The Xxyopen novel software (versions through 3.5.0 ) contains a weak password hashing vulnerability. The UserServiceImpl.register() function stores unsalted MD5 digests in the user_info.password field. If an attacker gains access to the password column via a database leak or backup exposure, they...

EUVD-2025-18961

Malicious code in bioql PyPI...

EUVD-2025-18972

Malicious code in bioql PyPI...

EUVD-2025-10031

Malicious code in bioql PyPI...

EUVD-2025-6164

Malicious code in bioql PyPI...

EUVD-2025-2029

Malicious code in bioql PyPI...

CVE-2025-6535

A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument...

CVE-2025-6535

CVE-2025-6535 affects xxyopen/201206030 novel-plus (up to 5.1.3). The vulnerability resides in the User Management Module, specifically the file path UserMapper.xml, where manipulation of the sort and order arguments leads to SQL injection. Exploitation is possible remotely, and public disclosure...

CVE-2025-6535 xxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injection

A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument...

CVE-2025-6534

A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper...

CVE-2025-6533 xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay

A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulatio...

CVE-2025-6533

CVE-2025-6533 affects xxyopen/201206030 novel-plus (up to v5.1.3). The vulnerability resides in ajaxLogin (LoginController.java, CATCHA Handler) and enables authentication bypass via capture-replay. Attack vector is remote over network; attack complexity is high, but public PoC/exploitation info ...

CVE-2025-6533

A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulatio...

CVE-2025-6533: Authentication Bypass by Capture-replay

A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulatio...

CVE-2025-6535: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument...

CVE-2025-6534: Improper Control of Resource Identifiers

A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper...

CVE-2025-3676

A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2025-3856

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3856

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3856

CVE-2025-3856 affects xxyopen Novel-Plus 5.1.0. The vulnerability is in the /book/searchByPage function, where the sort parameter is manipulated to trigger a SQL injection. It can be exploited remotely, and public disclosure exists. Connected documents consistently identify the vulnerable endpoin...