CVE-2025-65442: XSS
DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (bookcomment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization. Even if modern browsers' built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65442?
CVE-2025-65442 is considered a high severity vulnerability due to its potential for remote code execution and sensitive information disclosure.
How do I fix CVE-2025-65442?
To fix CVE-2025-65442, update to the patched version of the software that addresses the DOM-based XSS vulnerability.
What is the impact of CVE-2025-65442?
The impact of CVE-2025-65442 includes the execution of arbitrary JavaScript code and the potential exposure of user session cookies.
Who is affected by CVE-2025-65442?
CVE-2025-65442 affects users of the 201206030 product version V3.5.0.
How can CVE-2025-65442 be exploited?
CVE-2025-65442 can be exploited through crafted URL parameters or injecting malicious scripts into the window.localStorage.