PT-2025-18060 · Unknown · Novel-Plus

Aibot88 · Published 2025-04-28 · Updated 2025-10-17 · CVE-2025-4015

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novel-Plus versions 20120630 through 0e156c04b4b7ce0563bef6c97af4476fcda8f160

Description A critical issue has been found that affects the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. This issue leads to missing authentication and can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted prior to disclosure but did not respond.

Recommendations For Novel-Plus versions 20120630 through 0e156c04b4b7ce0563bef6c97af4476fcda8f160, as a temporary workaround, consider disabling the SessionController.java file until a patch is available. Restrict access to the SessionController.java function list to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2025-4015

Affected Products

Novel-Plus

References · 11

• 🔥 https://cnblogs.com/aibot/p/18827501 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4015 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4015 · Vendor Advisory
• https://vuldb.com/?submit.558367 · Note
• https://vuldb.com/?ctiid.306368 · Note
• https://t.me/cvenotify/120016 · Telegram Post
• https://t.me/cvedetector/23894 · Telegram Post
• https://t.me/cvetracker/22518 · Telegram Post
• https://t.me/cveNotify/139194 · Telegram Post
• https://vuldb.com/?id.306368 · Note
• https://twitter.com/cybercronai/status/1916886494972723249 · Twitter Post