These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint, allowing authenticated backend accounts to export complete book text, including paid chapters, without proper verification. This issue enables attackers to bypass permission checks and data-scope limits, potentially leading to unauthorized access to sensitive content. The vulnerability affects [truncated]
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint, allowing anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. This insecure default password can lead to unauthorized cache invalidation, potentially causing increased database queries and performance impacts. Defenders managing [truncated]
A novel-plus through 5.3.3 information disclosure vulnerability exists in the /sys/user/list endpoint due to missing permission annotations. Authenticated attackers within their data scope can retrieve user data including password hashes, email addresses, and phone numbers. This vulnerability allows offline hash cracking and potential account takeover. Defenders should assess exposure and implement mitiga [truncated]