CVE-2025-65442
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A DOM-based Cross-Site Scripting (XSS) vulnerability in novel V3.5.0 (201206030) allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The issue arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization.
Risk Assessment
Attackers can steal user sessions, take over accounts, or perform unauthorized actions in the victim's browser context, potentially leading to data confidentiality and integrity breaches.
Recommendation
Implement input and output sanitization, avoid using v-html without filtering, and apply Content Security Policy (CSP) to mitigate XSS impact.
Other vulnerabilities in novel
See all- CVE-2026-123677Medium
A vulnerability was found in xxyopen/201206030 novel up to version 3.5.0 in the getBookChapter function of BookServiceImpl.java, which handles book chapter reading. Manipulating the chapterId argument results in an authorization bypass, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-123676Medium
A vulnerability has been found in xxyopen/201206030 novel up to version 3.5.0 in the BookServiceImpl.getBookContentAbout function of BookServiceImpl.java, which handles book content. Manipulating the chapterId argument leads to improper authorization, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization. Even if modern browsers' built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS