Gsbp

**Name of the Vulnerable Software and Affected Versions** xxyopen novel plus versions prior to 4.4.0 **Description** The issue allows a remote attacker to execute arbitrary code via the PageController.java file. **Recommendations** For versions prior to 4.4.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the PageController.java file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** xxyopen Novel versions up to 3.4.1 **Description** A critical issue has been found in the software, affecting some unknown functionality of the file "/api/front/search/books". The manipulation of the `sort` argument leads to SQL injection. The attack can be launched remotely. Other parameters might also be affected. **Recommendations** For versions up to 3.4.1, as a temporary workaround, consider restricting access to the "/api/front/search/books" endpoint until a patch is available. Avoid using the `sort` argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Nome do Software Vulnerável e Versões Afetadas** y project RuoYi versões até a 4.8.0 **Descrição** Foi identificado um problema crítico no componente Whitelist, afetando especificamente a função `getBeanName`. Este problema resulta em vulnerabilidade de desserialização e pode ser explorado remotamente. O exploit foi divulgado publicamente e o fornecedor foi contatado, mas não respondeu. **Recomendações** y project RuoYi versões até a 4.8.0: Atualize o componente Whitelist para prevenir ataques de desserialização corrigindo a função `getBeanName`.