xxyopen novel-plus

SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list.

novel-plus list sql injection

xxyopen/201206030 novel-plus File FileController.java remove resource injection

20120630 Novel-Plus LogController.java list improper authorization

An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file

xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay

Novel-Plus HTTP POST Request updateUserInfo cross site scripting

Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter.

Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user can inject malicious JavaScript through the replyContent parameter when replying to a book comment. The payload is stored in the database and is executed in other users’ browsers when they view the affected comment thread.

Novel-Plus Friendly Link FriendLinkController.java cross site scripting