DOM-based XSS Vulnerability in Novel by 201206030
CVE-2025-65442

6.1MEDIUM

Key Information:

Vendor

201206030

Status
Novel
Vendor
CVE Published:
29 December 2025

What is CVE-2025-65442?

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Novel version 3.5.0 developed by 201206030. This issue allows remote attackers to execute arbitrary JavaScript code or extract sensitive information, including user session cookies, by manipulating the 'wvstest' parameter in the URL or injecting harmful scripts into window.localStorage. The root cause stems from inadequate validation and encoding of user inputs within the book comment module. Unfiltered user data is stored in the database and returned via API, then rendered directly in the page DOM using Vue 3's v-html directive without proper sanitization. Attackers can employ concealed payloads that evade standard browser XSS protections, leading to potential exploitation and user data compromise.

References

https://github.com/201206030/novel
https://github.com/201206030/novel-front-web
https://github.com/zero-day348/DOM-based-Cross-Site-Scrip...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.