novel-plus vulnerabilities and fixes

Recent CVEs affecting novel-plus, with upgrade or downgrade steps. 15 tracked.

Also searched as: novel plus.

novel-plus has 15 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 11. Most recent: 2025-10-08. Highest priority: CVE-2025-45890 (score 66/100).

• CVE-2025-6535 MEDIUM 6.3 UPGRADE A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical
• CVE-2025-6534 MEDIUM 4.2 UPGRADE A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3
• CVE-2025-6533 MEDIUM 5.6 UPGRADE A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3
• CVE-2025-60299 MEDIUM 5.4 DOWNGRADE Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /boo
• CVE-2025-60298 MEDIUM 5.4 UPGRADE Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /au
• CVE-2025-4019 HIGH 7.3 UPGRADE A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563be
• CVE-2025-4018 MEDIUM 5.3 UPGRADE A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0
• CVE-2025-4017 MEDIUM 4.3 UPGRADE A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af44
• CVE-2025-4016 MEDIUM 5.4 UPGRADE A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af
• CVE-2025-4015 MEDIUM 5.3 UPGRADE A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160
• CVE-2025-45890 CRITICAL 9.8 UPGRADE Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary c
• CVE-2025-3856 MEDIUM 6.3 DOWNGRADE A vulnerability was found in xxyopen Novel-Plus 5.1.0
• CVE-2025-3676 MEDIUM 6.3 DOWNGRADE A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0
• CVE-2025-3369 MEDIUM 6.3 DOWNGRADE A vulnerability was found in xxyopen Novel-Plus 5.1.0
• CVE-2025-26182 MEDIUM 6.5 UPGRADE An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the P

FAQ

How do I fix novel-plus vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is novel-plus being exploited right now?

None of the tracked novel-plus CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which novel-plus CVE should I patch first?

CVE-2025-45890 currently ranks highest (66/100): Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary c.

RSS feed for novel-plus · ← Back to latest CVEs