CVE-2025-4019
High
Description
A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
SeverityHigh
CVSS7.3
Exploit probability—
ProductXxyopen Novel-plus
PublishedApr 28, 2025
First seenApr 28, 2025
How to fix
Update
- xxyopen novel-plus5.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xxyopen novel-plus | v < 5.1.1 | 5.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.