CVE-2025-65442Medium· 6.1▾ TwilightPoC available

DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score46/ 100 · Moderate

impact 33.6 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Dec 29, 2025

Updated

Oct 5, 2026

CVSS

6.1

Vendor

xxyopen

Product

novel

CWE

CWE-79

Depth score

46 · Moderate

EPSS

0.36% · p27

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-05

GitHub PoCs

1 public repository

zero-day348/CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79- ↗

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 281 days

Dec 29, 2025Published
Disclosed via NVD
Oct 5, 2026Record revised
Last analysed / modified upstream
Oct 5, 2026EPSS first tracked
0.4%
Oct 5, 2026Public exploit observed
1 GitHub repo (last check)

xxyopen CWE-79 #nvd #exploit-available

Affected

novel = 3.5.0

Full technical detail▾

Overview

DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization. Even if modern browsers' built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.

Affected

novel = 3.5.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available