CVE-2025-6534— xxyopen/201206030 novel-plus File FileController.java remove resource injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-6534
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xxyopen/201206030 novel-plus File FileController.java remove resource injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对资源描述符的控制不恰当(资源注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
novel-plus 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
novel-plus是xxy个人开发者的一个小说阅读软件。 novel-plus 5.1.3及之前版本存在安全漏洞，该漏洞源于文件处理组件对资源标识符控制不当，可能导致远程攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xxyopen | novel-plus | 5.1.0 | - | |
| 201206030 | novel-plus | 5.1.0 | - |
II. Public POCs for CVE-2025-6534
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-6534
请登录查看更多情报信息。
- Submit #596505: xxyopen novel-plus v5.1.3 Improper Authorizationthird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-6534
Same Patch Batch · xxyopen · 2025-06-24 · 3 CVEs total
| CVE-2025-6535 | 6.3 MEDIUM | xxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injection |
| CVE-2025-6533 | 5.6 MEDIUM | xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay |
IV. Related Vulnerabilities
Same product: novel-plus
- CVE-2025-6535
xxyopen/201206030 novel-plus User Management Module UserMapp - CVE-2025-6533
xxyopen/201206030 novel-plus CATCHA LoginController.java aja - CVE-2025-4019
20120630 Novel-Plus GeneratorController.java genCode missing - CVE-2025-4018
20120630 Novel-Plus CrawlController.java addCrawlSource miss - CVE-2025-4017
20120630 Novel-Plus LogController.java list improper authori
Same vendor: xxyopen
- CVE-2025-6535
xxyopen/201206030 novel-plus User Management Module UserMapp - CVE-2025-6533
xxyopen/201206030 novel-plus CATCHA LoginController.java aja - CVE-2025-3856
xxyopen Novel-Plus searchByPage sql injection - CVE-2025-3676
xxyopen Novel-Plus books sql injection - CVE-2025-3369
xxyopen Novel-Plus list sql injection
Same weakness: CWE-99
- CVE-2026-7303
Xuxueli xxl-job Execution Log JobLogController.java logDetai - CVE-2026-5414
Newgen OmniDocs WebApiRequestRedirection resource injection - CVE-2026-5031
BichitroGan ISP Billing Software Endpoint users-view resourc - CVE-2026-3693
Shy2593666979 AgentChat User Endpoint user.py update_user_in - CVE-2025-12919
EverShop Order Order.resolvers.js resource injection
V. Comments for CVE-2025-6534
No comments yet