CVE-2026-123676Medium· 5.3▾ SunlitA vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Boo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.
novel 3.0novel 3.1novel 3.2novel 3.3novel 3.4novel 3.5.0novel 3.0novel 3.1novel 3.2novel 3.3novel 3.4novel 3.5.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123677Medium· 4.3xxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization
CVE-2026-110104Medium· 5.9Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password
CVE-2026-120224Critical· 9.9Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization
CVE-2025-10276Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization