CVE-2025-3676 is a Medium severity (CVSS 6.3) SQL injection in xxyopen Novel-Plus 3.5.0. The sort parameter of the book search endpoint is the weak point. The vendor did not respond to the reporter, and the record names no fix, so restrict access and fix the query.
What's affected
The record names xxyopen Novel-Plus 3.5.0. The vulnerable code is the file /api/front/search/books, through the sort parameter.
The record names no fixed version, and I found no vendor advisory. The record says the vendor did not respond to the researcher. Treat the product as unpatched until its maker says otherwise.
How to check if you're exposed
Start by finding out whether you run the product. Check web server document roots, container images and old project folders for it, and look at the version in the admin area or the installed files.
If you do run it, review web server and database logs for unusual requests to that page, especially ones containing quote characters, SQL keywords or very long values in the parameter. Unexpected database errors in the application log are another sign. Do not test the flaw against a system you do not own.
What to do now
- Locate every copy of the application, including test and demo installs.
- Take it off the internet or put it behind a VPN or an IP allow list until it is fixed.
- Ask the vendor or project for a fix, and watch the advisory sources for one.
- If you can change the code, switch the query to a parameterised statement and validate the value as the type it should be.
- Use a database account with only the access the application needs, so a flaw cannot reach other data.
- Back up the database, and review it and your logs for signs of tampering.
Why it matters
The weakness is CWE-74 (Injection), CWE-89 (SQL Injection). The application builds a database query by joining text that comes from the request into the SQL statement. Because the database cannot tell the developer's SQL from the attacker's text, crafted input changes what the query does. The usual impact is reading or changing data in the database, and sometimes more.
The vector is network, low complexity, low privileges and no interaction, with low impact on each of confidentiality, integrity and availability, giving 6.3. The need for a low privilege login is the reason this is Medium and not High.
The record says the exploit has been disclosed to the public and that the vendor was contacted early but did not respond. That combination is the real issue. A public method and no vendor fix mean that owners must protect themselves. With no vendor fix, the practical step for owners is to patch the query in their own copy.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Has the vendor fixed it?
The record says the vendor was contacted early and did not respond in any way. It names no fixed version.
What is the code level fix?
Use a parameterised query for the search, and accept only known values for a sort field.
Sources
Last reviewed: 18 October 2026.
