CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

Arbitrary file deletion

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

Hardcoded credentials

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-36672

CVE-2022-36672 affects Novel-Plus (v3.6.2) where a hard-coded JWT key is located in the project config file, enabling attackers to create custom user sessions. The NVD entry cites a critical impact (CVSS 3.1: 9.8; NETWORK, LOW complexity, NONE privileges required, with HIGH confidentiality, integ...

CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

CVE-2022-36671

CVE-2022-36671 affects Novel-Plus v3.6.2, with an arbitrary file download vulnerability exposed via the background file download API. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-based, unauthenticated issue with high impact to confidentiality and no impact on integri...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

novel-plus 安全漏洞

novel-plus novel-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus v3.6.2, which can be exploited to download arbitrary files via the background file download API...

PT-2022-23541 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 3.6.2 Description: The issue allows for an arbitrary file download via the "background file download API". Recommendations: For Novel-Plus version 3.6.2, consider restricting access to the background file download API until...

novel-plus 信任管理问题漏洞

novel-plus 小说精品屋-plus is a multiterminal PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus version v3.6.2, which stems from the inclusion of a hard-coded JWT key located in the project configuration file, which allows an attacker to creat...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

Sql injection

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

CVE-2022-35121 affects Novel-Plus v3.6.1 with a SQL injection via the keyword parameter on the endpoint /service/impl/BookServiceImpl.java. The NVD entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, no privileges required, and user interaction not needed; impact is H...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

novel-plus SQL注入漏洞

novel-plus novel-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus v3.6.1, which is caused by an SQL injection vulnerability in the keyword parameter /service/impl/BookServiceImpl.java...

PT-2022-22587 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 3.6.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the keyword parameter at the /service/impl/BookServiceImpl.java endpoint. Recommendations: For Novel-Plus version 3.6.1, consider...