CVE-2026-90940
MediumCVSS 5.3Summary
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Risk Assessment
Attackers can slow down the application by forcing frequent cache refreshes, leading to performance degradation and potential DoS.
Recommendation
Change the default cache-management password to a strong, unique one and protect the endpoint with authentication requirements.
Other vulnerabilities in novel-plus
See all- CVE-2026-90941Medium
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
- CVE-2026-90939Medium
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
- CVE-2023-37847Critical
A SQL injection vulnerability was discovered in novel-plus version 3.6.2. This flaw could allow an attacker to manipulate database queries.
Original NVD description (English source)
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.