CVE-2025-3676: xxyopen Novel-Plus books sql injection

Published Apr 16, 2025

Updated

A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

xxyopen Novel-Plus

xxyopen Novel-Plus=3.5.0

Event History

Apr 16, 2025

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeakness

May 17, 57277

Event

via FIRST·10:28 PM

Frequently Asked Questions

What is the severity of CVE-2025-3676?

CVE-2025-3676 is classified as a critical vulnerability affecting xxyopen Novel-Plus 3.5.0.

How do I fix CVE-2025-3676?

To fix CVE-2025-3676, ensure you update xxyopen Novel-Plus to the latest version where the vulnerability is patched.

What type of attack does CVE-2025-3676 allow?

CVE-2025-3676 allows for SQL injection attacks due to improper handling of the 'sort' argument.

Is remote exploitation possible with CVE-2025-3676?

Yes, CVE-2025-3676 can be exploited remotely.

Which file is affected by CVE-2025-3676?

CVE-2025-3676 affects the /api/front/search/books file in xxyopen Novel-Plus 3.5.0.