GCVE - cpe:2.3:a:xxyopen:novel-plus:3.6.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xxyopen:novel-plus:3.6.2:*:*:*:*:*:*:*

part: a version: 3.6.2 update: *

Vendor	Xxyopen (`31c30ce2-5774-57c4-9362-92839f121101`)
Product	Novel Plus (`65481d84-2d8b-5c78-9bd0-3427c7c80b15`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/201206030/novel-plus`	purl2cpe	2026-06-01 10:13:04.336016

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-37847`	vulnerable	2026-06-08 06:08:16.002482	Details available novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability. Published: 2023-08-14T00:00:00.000Z Updated: 2026-07-09T00:27:07.436Z Open on db.gcve.eu Reference links https://novel.xxyopen.com/index.htm https://github.com/KingBangQ/CVE-2023-37847/blob/main/README.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-30058`	vulnerable	2026-06-08 06:02:43.801528	Details available novel-plus 3.6.2 is vulnerable to SQL Injection. Published: 2023-09-11T00:00:00.000Z Updated: 2024-09-26T18:38:24.070Z Open on db.gcve.eu Reference links https://github.com/201206030/novel-plus https://github.com/Rabb1tQ/HillstoneCVEs/tree/main/CVE-2023-30058 https://github.com/Rabb1tQ/HillstoneCVEs/blob/main/CVE-2023-30058/CVE-2023-30058.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2041`	vulnerable	2026-06-08 06:02:41.299571	novel-plus sql injection MEDIUM (6.3) A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2023-04-14T09:00:06.961Z Updated: 2025-02-06T19:52:45.149Z Open on db.gcve.eu Reference links https://vuldb.com/?id.225919 https://vuldb.com/?ctiid.225919 https://github.com/langove/llov/blob/main/Novel-Plus%20code%20audit.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2040`	vulnerable	2026-06-08 06:02:41.298898	novel-plus sql injection MEDIUM (6.3) A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2023-04-14T08:31:03.374Z Updated: 2024-08-02T06:12:19.947Z Open on db.gcve.eu Reference links https://vuldb.com/?id.225918 https://vuldb.com/?ctiid.225918 https://github.com/morty-py/morty/blob/main/Novel-Plus3.6.2%20sqli.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2039`	vulnerable	2026-06-08 06:02:41.298337	novel-plus sql injection MEDIUM (6.3) A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225917 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2023-04-14T08:00:05.391Z Updated: 2025-02-06T20:01:23.919Z Open on db.gcve.eu Reference links https://vuldb.com/?id.225917 https://vuldb.com/?ctiid.225917 https://github.com/yece688/yece/blob/main/Novel-Plus%20Code%20audit2.0.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1607`	vulnerable	2026-06-08 05:52:36.182411	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1606`	vulnerable	2026-06-08 05:52:36.182038	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1595`	vulnerable	2026-06-08 05:52:36.168405	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1594`	vulnerable	2026-06-08 05:52:36.167757	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36672`	vulnerable	2026-06-08 05:46:07.655219	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36671`	vulnerable	2026-06-08 05:46:07.654764	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.