6 results · Clear filters · Feed
-
Medium 4.3
novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retr…
-
Medium 5.3
novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can tr…
-
Medium 6.5
novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbe…
-
Medium 6.3
xxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injection
A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Modul…
-
Medium 4.2
xxyopen/201206030 novel-plus File FileController.java remove resource injection
A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler…
-
Medium 5.6
xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay
A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the com…