CVE-2025-65442

DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization. Even if modern browsers' built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.

• CWE-79

• https://github.com/201206030/novelProduct
• https://github.com/201206030/novel-front-webNot Applicable
• https://github.com/zero-day348/DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-Exploit, Third Party Advisory

Published

Dec 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6542An arbitrary OS command may be executed on the product by a …9.8
• CVE-2025-65427An issue was discovered in Dbit N300 T1 Pro Easy Setup Wirel…6.5
• CVE-2025-6543Memory overflow vulnerability leading to unintended control …9.8
• CVE-2025-65430An issue was discovered in allauth-django before 65.13.0. Id…5.4
• CVE-2025-65431An issue was discovered in allauth-django before 65.13.0. Bo…5.4
• CVE-2025-6544A deserialization vulnerability exists in h2oai/h2o-3 versio…9.8
• CVE-2025-6545Improper Input Validation vulnerability in pbkdf2 allows Sig…9.1
• CVE-2025-6546The Drive Folder Embedder plugin for WordPress is vulnerable…5.4
• CVE-2025-65465A reflected Cross-Site Scripting (XSS) vulnerability in the …6.1
• CVE-2025-6547Improper Input Validation vulnerability in pbkdf2 allows Sig…9.1
• CVE-2025-65471An arbitrary file upload vulnerability in the /admin/manager…8.8
• CVE-2025-65472A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.…8.8