Is there a public PoC exploit available for CVE-2025-6533?

Yes, a public proof-of-concept exploit is available for CVE-2025-6533. Prioritise patching immediately. EPSS: 0.1%.

Novel Plus CVE-2025-6533

Q: What is the CVSS score of CVE-2025-6533?

CVE-2025-6533 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18961 LOW

Improper Authentication (CWE-287)

2025-06-24 cna@vuldb.com

Authentication Bypass Java Novel Plus Xxyopen

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.6 MEDIUM

Remote, high complexity due to CAPTCHA token capture and replay; impact limited to credential brute-force.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.6 (MEDIUM) 2.9 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-18961

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

PoC Detected

Oct 01, 2025 - 19:48 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 00:15 nvd

MEDIUM 5.6

CVE Published

Jun 24, 2025 - 00:15 cve.org

LOW 2.9

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation leads to authentication bypass by capture-replay. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass via CAPTCHA replay in Novel Plus versions up to 5.1.3 allows remote attackers to circumvent brute-force protections. The flaw in the ajaxLogin function's CATCHA handler permits reuse of valid CAPTCHA tokens, enabling credential guessing attacks. Publicly available exploit code exists, but exploitation is difficult and no active exploitation has been confirmed.

Technical ContextAI

The vulnerability is an authentication bypass by capture-replay (CWE-287) in the novel-admin module of Novel Plus, an open-source Java-based novel reading platform. The affected component is the LoginController.java file's ajaxLogin function, which handles CAPTCHA verification during login. The CATCHA handler fails to invalidate tokens after use, allowing an attacker to capture a valid CAPTCHA response from a legitimate request and replay it in subsequent attempts, thereby defeating brute-force protection. The CPE data confirms that the entire product line up to version 5.1.3 is affected.

RemediationAI

No vendor-released patch is available; the maintainer did not respond to disclosure. To remediate, immediate application of a code fix to the CATCHA token handling in LoginController.java is necessary: implement one-time token invalidation immediately after valid verification. Alternatively, consider replacing the CAPTCHA logic with a library that inherently prevents token reuse. As compensating controls, enforce account lockout after a small number of failed login attempts without relying solely on CAPTCHA, and monitor login logs for replay patterns. Note that the attack complexity is high, so these mitigations effectively reduce risk while awaiting an upstream patch.