xxyopen records

53 published records for vendor xxyopen.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 6
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

53 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2021-41921No exploit	novel-plus V3.6.1 allows unrestricted file uploads.xxyopen · novel-plus · CWE-434 pre-auth RCE File upload	Critical9.8	—	1.7%	Apr 28, 2022
39Monitor	CVE-2025-45890No exploit	Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameterxxyopen · novel-plus · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	1.5%	Jun 20, 2025
39Monitor	CVE-2022-36672No exploit	Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.xxyopen · novel-plus · CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	1.3%	Aug 31, 2022
39Monitor	CVE-2022-24568No exploit	Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.xxyopen · novel-plus · CWE-918 Pre-auth SSRF	Critical9.8	—	1.1%	Feb 10, 2022
39Monitor	CVE-2023-46981No exploit	SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort paramexxyopen · novel-plus · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.1%	Nov 4, 2023
39Monitor	CVE-2021-42967No exploit	Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows axxyopen · novel-plus · CWE-434 Pre-auth File upload	Critical9.8	—	1.0%	May 13, 2022
39Monitor	CVE-2023-1594No exploit	novel-plus list MenuService sql injectionxxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.0%	Mar 23, 2023
39Monitor	CVE-2023-30058No exploit	novel-plus 3.6.2 is vulnerable to SQL Injection.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.0%	Sep 11, 2023
39Monitor	CVE-2022-35121No exploit	Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.9%	Aug 17, 2022
39Monitor	CVE-2023-1606No exploit	novel-plus DictController.java sql injectionxxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.8%	Mar 23, 2023
39Monitor	CVE-2024-25274No exploit	An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code xxyopen · novel-plus · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.7%	Feb 20, 2024
39Monitor	CVE-2023-37847No exploit	novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.7%	Aug 14, 2023
39Monitor	CVE-2024-0655No exploit	Novel-Plus list sql injectionxxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.7%	Jan 17, 2024
39Monitor	CVE-2024-24026No exploit	An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserControllerxxyopen · novel-plus · CWE-434 Pre-auth File upload	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-0941No exploit	Novel-Plus list sql injectionxxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Jan 26, 2024
39Monitor	CVE-2024-24025No exploit	An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload().xxyopen · novel-plus · CWE-434 Pre-auth File upload	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24024No exploit	An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownxxyopen · novel-plus · CWE-434 Pre-auth File upload	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24017No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24023No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24014No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24021No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24015No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Feb 6, 2024
39Monitor	CVE-2024-24018No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Feb 7, 2024
39Monitor	CVE-2024-24013No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.5%	Feb 6, 2024
39Monitor	CVE-2024-24019No exploit	A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.xxyopen · novel-plus · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.5%	Feb 6, 2024

CVE-2021-41921
40Plan
novel-plus V3.6.1 allows unrestricted file uploads.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
xxyopen · novel-plusApr 28, 2022
CVE-2025-45890
39Monitor
Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Path traversal
xxyopen · novel-plusJun 20, 2025
CVE-2022-36672
39Monitor
Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Hard-coded credentials
xxyopen · novel-plusAug 31, 2022
CVE-2022-24568
39Monitor
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SSRF
xxyopen · novel-plusFeb 10, 2022
CVE-2023-46981
39Monitor
SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parame
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
xxyopen · novel-plusNov 4, 2023
CVE-2021-42967
39Monitor
Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows a
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- File upload
xxyopen · novel-plusMay 13, 2022
CVE-2023-1594
39Monitor
novel-plus list MenuService sql injection
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
xxyopen · novel-plusMar 23, 2023
CVE-2023-30058
39Monitor
novel-plus 3.6.2 is vulnerable to SQL Injection.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
xxyopen · novel-plusSep 11, 2023
CVE-2022-35121
39Monitor
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusAug 17, 2022
CVE-2023-1606
39Monitor
novel-plus DictController.java sql injection
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusMar 23, 2023
CVE-2024-25274
39Monitor
An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
xxyopen · novel-plusFeb 20, 2024
CVE-2023-37847
39Monitor
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusAug 14, 2023
CVE-2024-0655
39Monitor
Novel-Plus list sql injection
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusJan 17, 2024
CVE-2024-24026
39Monitor
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
xxyopen · novel-plusFeb 7, 2024
CVE-2024-0941
39Monitor
Novel-Plus list sql injection
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusJan 26, 2024
CVE-2024-24025
39Monitor
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload().
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24024
39Monitor
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDown
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24017
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24023
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24014
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24021
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24015
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 6, 2024
CVE-2024-24018
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 7, 2024
CVE-2024-24013
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 6, 2024
CVE-2024-24019
39Monitor
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
xxyopen · novel-plusFeb 6, 2024