CVE-2025-6534: falha de baixa gravidade em 201206030 novel-plus
xxyopen/201206030 novel-plus File FileController.java remove resource injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.5%
A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVEs relacionadas — 201206030 novel-plus
No mesmo produto, das mais perigosas para as menos.
CVE-2025-6533MEDIUMxxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replayEPSS 0.6%CVE-2026-90940MEDIUMnovel-plus through 5.3.3 Default Cache Management Password in the Front PortalEPSS 0.5%CVE-2025-6535MEDIUMxxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injectionEPSS 0.5%CVE-2026-90939HIGHnovel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list EndpointEPSS 0.5%CVE-2026-90941MEDIUMnovel-plus through 5.3.3 Missing Authorization on the Admin Book Download EndpointEPSS 0.4%