CVE-2022-36672: Xxyopen Novel-Plus

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.

Affected products

• Xxyopen Novel-Plus: version 3.6.2 only

Published 2022-09-01. Last modified 2026-06-17.