What’s Vulnerable › Products

novel-plus vulnerabilities

53 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your novel-plus version is affected

Latest novel-plus vulnerabilities

• CVE-2026-90941 — novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint (CVSS 4.3)
• CVE-2026-90940 — novel-plus through 5.3.3 Default Cache Management Password in the Front Portal (CVSS 5.3)
• CVE-2026-90939 — novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint (CVSS 6.5)
• CVE-2025-60299 — (CVSS 5.4)
• CVE-2025-60298 — (CVSS 5.4)
• CVE-2025-6535 — xxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injection (CVSS 8.8)
• CVE-2025-6534 — xxyopen/201206030 novel-plus File FileController.java remove resource injection (CVSS 6.8)
• CVE-2025-6533 — xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay (CVSS 5.9)
• CVE-2025-45890 — (CVSS 9.8)
• CVE-2025-4019 — 20120630 Novel-Plus GeneratorController.java genCode missing authentication (CVSS 9.8)
• CVE-2025-4018 — 20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication (CVSS 7.5)
• CVE-2025-4017 — 20120630 Novel-Plus LogController.java list improper authorization (CVSS 6.5)
• CVE-2025-4016 — 20120630 Novel-Plus LogController.java deleteIndex improper authorization (CVSS 9.1)
• CVE-2025-4015 — 20120630 Novel-Plus SessionController.java list missing authentication (CVSS 7.5)
• CVE-2025-3856 — xxyopen Novel-Plus searchByPage sql injection (CVSS 9.8)
• CVE-2025-3676 — xxyopen Novel-Plus books sql injection (CVSS 9.8)
• CVE-2025-3369 — xxyopen Novel-Plus list sql injection (CVSS 9.8)
• CVE-2025-26182 — (CVSS 6.5)
• CVE-2024-33383 — (CVSS 7.5)
• CVE-2024-25274 — (CVSS 9.8)
• CVE-2024-24021 — (CVSS 9.8)
• CVE-2024-24017 — (CVSS 9.8)
• CVE-2024-24014 — (CVSS 9.8)
• CVE-2024-24026 — (CVSS 9.8)
• CVE-2024-24025 — (CVSS 9.8)