Which versions of Novel-Plus are affected by EUVD-2025-18967?

Organizations using xxyopen/201206030 novel-plus should be aware of moderate risk from CVE-2025-6535, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for EUVD-2025-18967?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18967. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18967?

Within 30 days: Identify affected systems running xxyopen/201206030 novel-plus and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Novel-Plus EUVD-2025-18967

Q: What is the CVSS score of EUVD-2025-18967?

EUVD-2025-18967 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6535 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-24 cna@vuldb.com

SQLi Novel Plus Xxyopen

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

PR:L due to auth required; C:L/I:L as SQLi can read/write limited data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-18967

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

PoC Detected

Jul 09, 2025 - 19:08 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 01:15 nvd

MEDIUM 6.3

CVE Published

Jun 24, 2025 - 01:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/order leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Novel-Plus up to 5.1.3 allows authenticated remote attackers to extract sensitive data via the sort/order parameters in the User Management Module. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.05%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a SQL injection (CWE-74) in the MyBatis mapper file UserMapper.xml, which handles user list queries. The sort and order parameters are not sanitized, allowing injection of SQL commands. The affected product is Novel-Plus, a Java-based novel management system, as identified by CPE cpe:2.3:a:xxyopen:novel-plus:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch is available as the vendor did not respond. Compensating controls include: restrict access to the User Management Module to trusted administrators only, implement a Web Application Firewall (WAF) with SQL injection rules, and sanitize sort/order parameters in the application code. Disabling the user list feature may also mitigate risk but could impact functionality.