CVE-2026-90940

Katalog CVE

CVSS 5.3 · Medium EPSS 0,55%

Kerentanan Use of Default Credentials. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

Rincian

Terbit di NVD

14 September 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1392: Use of Default Credentials

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/201206030/novel-plus
• https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/jav...
• https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/res...
• https://github.com/201206030/novel-plus/releases/tag/v5.3.3
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-07-front-cache-refresh-hardcoded-pass...
• https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-default-cache-management-password-in-the-front-p...