CVE-2025-3856

CVSS 3.1 Score 6.3 of 10 (medium)

Details

Published Apr 22, 2025
Updated: Apr 23, 2025
CWE ID 74
CWE ID 89

Summary

CVE-2025-3856 is a critical vulnerability identified in xxyopen Novel-Plus 5.1.0. The issue lies in the function searchByPage of the file /book. An attacker can exploit this vulnerability by manipulating the sort argument, leading to SQL injection. This vulnerability enables remote attacks and has been disclosed to the public. Despite early notification, the vendor has not responded to the disclosure.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share