CVE-2025-3856

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-3856

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3856.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-3856

Published

2025-04-22T01:00:11.753Z

Modified

2026-07-15T01:48:56.212772869Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

xxyopen Novel-Plus searchByPage sql injection

Details

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3856.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.1.0"
                },
                {
                    "last_affected": "5.1.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/201206030/novel-plus

Affected ranges

Type

GIT

Repo

https://github.com/201206030/novel-plus

Events

Introduced

8c1c0f10bef7de73b7eff322a31bd6396f688933

Last affected

8c1c0f10bef7de73b7eff322a31bd6396f688933

Database specific

{
    "cpe": "cpe:2.3:a:xxyopen:novel-plus:5.1.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.1.0"
        },
        {
            "last_affected": "5.1.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

5.*

5.1.0

v5.*

v5.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3856.json"