Xxyopen

Novel-plus

42 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2024-24014

  • EPSS 0.07%
  • Veröffentlicht 08.02.2024 02:15:07
  • Zuletzt bearbeitet 05.06.2025 19:15:26

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list

9.8

CVE-2024-24017

  • EPSS 0.06%
  • Veröffentlicht 08.02.2024 02:15:07
  • Zuletzt bearbeitet 21.11.2024 08:58:49

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /common/dict/list

9.8

CVE-2024-24026

  • EPSS 0.1%
  • Veröffentlicht 08.02.2024 01:15:27
  • Zuletzt bearbeitet 24.04.2025 16:15:27

An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download...

9.8

CVE-2024-24025

  • EPSS 0.1%
  • Veröffentlicht 08.02.2024 01:15:27
  • Zuletzt bearbeitet 12.06.2025 15:15:36

An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.

9.8

CVE-2024-24024

  • EPSS 0.1%
  • Veröffentlicht 08.02.2024 01:15:27
  • Zuletzt bearbeitet 21.11.2024 08:58:50

An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker can pass in specially crafted filePath and fieName parameters to perform arbitrary File do...

9.8

CVE-2024-24023

  • EPSS 0.07%
  • Veröffentlicht 08.02.2024 01:15:27
  • Zuletzt bearbeitet 21.11.2024 08:58:50

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.

9.8

CVE-2024-24018

  • EPSS 0.08%
  • Veröffentlicht 08.02.2024 01:15:27
  • Zuletzt bearbeitet 15.05.2025 20:15:45

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list

9.8

CVE-2024-24019

  • EPSS 0.07%
  • Veröffentlicht 07.02.2024 01:15:08
  • Zuletzt bearbeitet 05.06.2025 19:15:26

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list

9.8

CVE-2024-24015

  • EPSS 0.07%
  • Veröffentlicht 06.02.2024 16:15:52
  • Zuletzt bearbeitet 21.11.2024 08:58:49

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit

9.8

CVE-2024-24013

  • EPSS 0.07%
  • Veröffentlicht 06.02.2024 16:15:52
  • Zuletzt bearbeitet 12.06.2025 15:15:35

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list