Orta CVSS 5.4 PoC var
CVE-2025-60298: Novel-plus: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter.
Özet bilgiler
- Ürün
- Xxyopen Novel-plus
- CVSS v3.1
- 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - EPSS
- %0,27 (yüzdelik 19)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| xxyopen-novel-plus | — | 5.2.4 | — |