CVE-2025-60298

{
  "id": "CVE-2025-60298",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-08T13:15:34.627",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter."
    },
    {
      "lang": "es",
      "value": "Novel-Plus hasta la versión 5.2.4 se descubrió que contenía una vulnerabilidad de cross-site scripting (XSS) almacenado a través del endpoint /author/updateIndexName. Esta vulnerabilidad permite a atacantes autenticados inyectar código JavaScript malicioso a través del parámetro indexName, el cual se almacena en la base de datos y se ejecuta cuando otros usuarios ven el capítulo del libro afectado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-08T14:49:02.058652Z",
          "id": "CVE-2025-60298",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:xxyopen:novel-plus:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "5.2.4",
              "matchCriteriaId": "D5764449-A5BD-4C80-93FF-6AC581510571"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/201206030/novel-plus",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://notes.sjtu.edu.cn/s/FB0dX82qf",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://notes.sjtu.edu.cn/s/FB0dX82qf#",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}