Xxyopen vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-110104 Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.registerHigh 8.2 · Oct 13, 2026
• CVE-2025-45890 Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameterCritical 9.8 · Jun 20, 2025
• CVE-2024-24021 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.Critical 9.8 · Feb 7, 2024
• CVE-2024-24014 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.Critical 9.8 · Feb 7, 2024
• CVE-2024-24026 An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg().Critical 9.8 · Feb 7, 2024
• CVE-2024-24025 An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload().Critical 9.8 · Feb 7, 2024
• CVE-2024-24024 An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload().Critical 9.8 · Feb 7, 2024
• CVE-2024-24023 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.Critical 9.8 · Feb 7, 2024
• CVE-2024-24018 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.Critical 9.8 · Feb 7, 2024
• CVE-2024-24019 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.Critical 9.8 · Feb 6, 2024
• CVE-2024-24015 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.Critical 9.8 · Feb 6, 2024
• CVE-2024-24013 A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.Critical 9.8 · Feb 6, 2024
• CVE-2023-46981 SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/lCritical 9.8 · Nov 4, 2023
• CVE-2023-41443 SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/lisHigh 7.2 · Sep 18, 2023
• CVE-2023-30058 novel-plus 3.6.2 is vulnerable to SQL Injection.Critical 9.8 · Sep 11, 2023
• CVE-2023-37847 novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.Critical 9.8 · Aug 14, 2023
• CVE-2023-1594 A vulnerability, which was classified as critical, was found in novel-plus 3.6.2.High 7.3 · Mar 23, 2023
• CVE-2022-36672 Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.Critical 9.8 · Aug 31, 2022
• CVE-2022-36671 Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.High 7.5 · Aug 31, 2022
• CVE-2022-35121 Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.Critical 9.8 · Aug 17, 2022
• CVE-2021-42967 Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker toCritical 9.8 · May 13, 2022
• CVE-2022-28462 novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.High 7.5 · May 5, 2022
• CVE-2021-41921 novel-plus V3.6.1 allows unrestricted file uploads.Critical 9.8 · Apr 28, 2022
• CVE-2022-24568 Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.Critical 9.8 · Feb 10, 2022