Xxyopen

By the Year

In 2026 there have been 3 vulnerabilities in Xxyopen with an average score of 5.4 out of ten. Last year, in 2025 Xxyopen had 10 security vulnerabilities published. Right now, Xxyopen is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 2.53

Recent Xxyopen Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-90941	Sep 14, 2026	novel-plus 5.3.3 Auth Bypass via BookController Download novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.	Novel Plus
CVE-2026-90940	Sep 14, 2026	novel-plus 5.3.3 - insecure default cache password permits cache invalidation novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.	Novel Plus
CVE-2026-90939	Sep 14, 2026	Novel-Plus <=5.3.3 InfoDisclosure: /sys/user/list leaks password hashes novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.	Novel Plus
CVE-2025-6535	Jun 24, 2025	SQLi via sort/order in novel-plus <=5.1.3 UserMgmt (UserMapper.xml) A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/order leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-6534	Jun 24, 2025	xxyopen novel-plus <5.1.3 - FileHandler Remove Improper RI Control A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-6533	Jun 24, 2025	Auth Bypass via Capture-Replay in xxyopen/201206030 Novel-Plus <=5.1.3 A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation leads to authentication bypass by capture-replay. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus
CVE-2025-45890	Jun 20, 2025	Novel Plus <5.1.0 Directory Traversal Enables RCE via filePath Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter	Novel Plus
CVE-2025-4036	Apr 28, 2025	Novel 3.5.0 Improper Access Control via ChapterHandler:updateBookChapter A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel
CVE-2025-3956	Apr 27, 2025	SQLi in novel-cloud 1.4.0 RestResp (BookInfoMapper.xml) A vulnerability has been found in 201206030 novel-cloud 1.4.0 and classified as critical. This vulnerability affects the function RestResp of the file novel-cloud-master/novel-book/novel-book-service/src/main/resources/mapper/BookInfoMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Cloud
CVE-2025-3856	Apr 22, 2025	Critical SQLi in Novel-Plus 5.1.0 searchByPage (sort param) A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Novel Plus