An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.
References
| Link | Resource |
|---|---|
| https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a | Third Party Advisory |
| https://reference1.example.com/login | Product |
| https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a | Third Party Advisory |
| https://reference1.example.com/login | Product |
Configurations
History
02 Apr 2025, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:xxyopen:novel-plus:4.3.0:rc1:*:*:*:*:*:* | |
| First Time |
Xxyopen
Xxyopen novel-plus |
|
| References | () https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a - Third Party Advisory | |
| References | () https://reference1.example.com/login - Product |
21 Nov 2024, 09:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a - | |
| References | () https://reference1.example.com/login - |
29 Aug 2024, 20:36
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-434 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
20 Feb 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-20 16:15
Updated : 2025-04-02 20:19
NVD link : CVE-2024-25274
Mitre link : CVE-2024-25274
CVE.ORG link : CVE-2024-25274
JSON object : View
Products Affected
xxyopen
- novel-plus
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type