Xxyopen

By the Year

In 2026 there have been 0 vulnerabilities in Xxyopen. Last year, in 2025 Xxyopen had 10 security vulnerabilities published. Right now, Xxyopen is on track to have less security vulnerabilities in 2026 than it did last year.

Recent Xxyopen Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-6535	Jun 24, 2025	SQLi via sort/order in novel-plus <=5.1.3 UserMgmt (UserMapper.xml) A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/order leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-6534	Jun 24, 2025	xxyopen novel-plus <5.1.3 - FileHandler Remove Improper RI Control A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-6533	Jun 24, 2025	Auth Bypass via Capture-Replay in xxyopen/201206030 Novel-Plus <=5.1.3 A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation leads to authentication bypass by capture-replay. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-45890	Jun 20, 2025	Novel Plus <5.1.0 Directory Traversal Enables RCE via filePath Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter	Novel Plus
CVE-2025-4036	Apr 28, 2025	Novel 3.5.0 Improper Access Control via ChapterHandler:updateBookChapter A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel
CVE-2025-3956	Apr 27, 2025	SQLi in novel-cloud 1.4.0 RestResp (BookInfoMapper.xml) A vulnerability has been found in 201206030 novel-cloud 1.4.0 and classified as critical. This vulnerability affects the function RestResp of the file novel-cloud-master/novel-book/novel-book-service/src/main/resources/mapper/BookInfoMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Cloud
CVE-2025-3856	Apr 22, 2025	Critical SQLi in Novel-Plus 5.1.0 searchByPage (sort param) A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-3676	Apr 16, 2025	xxyopen Novel-Plus 3.5.0 API SQLi Remote (sort param) A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-3369	Apr 07, 2025	Novel-Plus 5.1.0 SQLi: sort param on /novel/friendLink/list A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.	Novel Plus
CVE-2025-26182	Mar 04, 2025	RCE via PageController.java in xxyopen novel plus <4.4.0 An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file	Novel Plus