https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-60299.htmlhttps://patchthecve.com/cve/CVE-2025-60299.htmlWed, 17 Jun 2026 09:49:38 +0000MEDIUM 5.4: Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user can inject malicious JavaScript through the replyContent parameter when replying to a book comment. The payload is stored in the database anhttps://patchthecve.com/cve/CVE-2025-60298.htmlhttps://patchthecve.com/cve/CVE-2025-60298.htmlWed, 17 Jun 2026 09:49:38 +0000MEDIUM 5.4: Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and exhttps://patchthecve.com/cve/CVE-2025-6535.htmlhttps://patchthecve.com/cve/CVE-2025-6535.htmlWed, 17 Jun 2026 10:02:06 +0000MEDIUM 6.3: A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/https://patchthecve.com/cve/CVE-2025-6534.htmlhttps://patchthecve.com/cve/CVE-2025-6534.htmlWed, 17 Jun 2026 10:02:05 +0000MEDIUM 4.2: A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper conthttps://patchthecve.com/cve/CVE-2025-6533.htmlhttps://patchthecve.com/cve/CVE-2025-6533.htmlWed, 17 Jun 2026 10:02:05 +0000MEDIUM 5.6: A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation lhttps://patchthecve.com/cve/CVE-2025-45890.htmlhttps://patchthecve.com/cve/CVE-2025-45890.htmlWed, 17 Jun 2026 09:25:49 +0000CRITICAL 9.8: Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameterhttps://patchthecve.com/cve/CVE-2025-4019.htmlhttps://patchthecve.com/cve/CVE-2025-4019.htmlWed, 17 Jun 2026 09:32:19 +0000HIGH 7.3: A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authenthttps://patchthecve.com/cve/CVE-2025-4018.htmlhttps://patchthecve.com/cve/CVE-2025-4018.htmlWed, 17 Jun 2026 09:32:19 +0000MEDIUM 5.3: A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlController.java. The manipulation leads to mhttps://patchthecve.com/cve/CVE-2025-4017.htmlhttps://patchthecve.com/cve/CVE-2025-4017.htmlWed, 17 Jun 2026 09:32:19 +0000MEDIUM 4.3: A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the function list of the file nnovel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorizhttps://patchthecve.com/cve/CVE-2025-4016.htmlhttps://patchthecve.com/cve/CVE-2025-4016.htmlWed, 17 Jun 2026 09:32:19 +0000MEDIUM 5.4: A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIndex of the file novel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorization.https://patchthecve.com/cve/CVE-2025-4015.htmlhttps://patchthecve.com/cve/CVE-2025-4015.htmlWed, 17 Jun 2026 09:32:19 +0000MEDIUM 5.3: A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. The manipulation leads to missing ahttps://patchthecve.com/cve/CVE-2025-3856.htmlhttps://patchthecve.com/cve/CVE-2025-3856.htmlWed, 17 Jun 2026 09:20:48 +0000MEDIUM 6.3: A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been discloshttps://patchthecve.com/cve/CVE-2025-3676.htmlhttps://patchthecve.com/cve/CVE-2025-3676.htmlWed, 17 Jun 2026 09:20:27 +0000MEDIUM 6.3: A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the pubhttps://patchthecve.com/cve/CVE-2025-3369.htmlhttps://patchthecve.com/cve/CVE-2025-3369.htmlWed, 17 Jun 2026 09:19:48 +0000MEDIUM 6.3: A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclhttps://patchthecve.com/cve/CVE-2025-26182.htmlhttps://patchthecve.com/cve/CVE-2025-26182.htmlWed, 17 Jun 2026 09:01:30 +0000MEDIUM 6.5: An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file