CVE-2025-60298

Published: Oct 8, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter.

Affected (1)

Products: Xxyopen: Novel Plus

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xxyopen Novel Plus	Up to 5.2.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/201206030/novel-plus

Source: cve@mitre.org

Product

https://notes.sjtu.edu.cn/s/FB0dX82qf

Source: cve@mitre.org

ExploitThird Party Advisory

https://notes.sjtu.edu.cn/s/FB0dX82qf#

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.