CVE Feed

    Dashboard / CVE / CVE-2026-90940

    CVE-2026-90940

    novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

    Published:Sep 14, 2026
    Last Modified:Sep 20, 2026
    EPS:Sep 14, 2026
    EPSS Score:0.00311
    CVSS Score:5.3

    Affected Products

    Vendor
    201206030
    Product
    Novel-plus
    Vendor
    Xxyopen
    Product
    Novel-plus

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-1392 Use of Default Credentials

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High