What’s Vulnerable › Vulnerabilities

CVE-2025-60298

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-08 · updated 2026-06-17
• Weakness: CWE-79

Description

Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter.

Affected products

• novel-plus: through 5.2.4

References

• https://github.com/201206030/novel-plus
• https://notes.sjtu.edu.cn/s/FB0dX82qf
• https://notes.sjtu.edu.cn/s/FB0dX82qf#

Get alerted when CVE-2025-60298 or the next vulnerability affects your stack