CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-26182

The xxyopen novel plus software (versions v.4.4.0 and before ) is vulnerable to a Remote Code Execution (RCE) flaw. The root cause involves improper control of generation of code (CWE-94) specifically within the PageController.java file. A remote attacker can exploit this issue to execute arbitra...

CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-26182

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

novel 代码注入漏洞

novel is an open source novel system by xxyopen open source. A security vulnerability exists in novel 4.4.0 and earlier versions, which stems from vulnerability to remote code execution attacks...

PT-2025-9684 · Unknown · Xxyopen Novel-Plus

Name of the Vulnerable Software and Affected Versions: xxyopen novel plus versions prior to 4.4.0 Description: The issue allows a remote attacker to execute arbitrary code via the PageController.java file. Recommendations: For versions prior to 4.4.0, update to a version that contains a fix for...

CVE-2025-26182: Improper Control of Generation of Code

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file...

CVE-2025-1154

A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2025-1154 xxyopen Novel books sql injection

A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2025-1154

A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2025-1154 xxyopen Novel books sql injection

A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2025-1154

CVE-2025-1154 affects xxyopen Novel up to 3.4.1. The /api/front/search/books endpoint is vulnerable due to manipulation of the sort parameter, which leads to SQL injection. The issue can be exploited remotely and the exploit has been disclosed publicly. Multiple sources (Red Hat, NVD/CVE listings...

CVE-2025-1154: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit...