PT-2025-41255

Name of the Vulnerable Software and Affected Versions Novel-Plus versions up to 5.2.4 Description The software contains a Stored Cross-Site Scripting XSS issue. Authenticated attackers can inject malicious JavaScript code through the indexName parameter of the /author/updateIndexName API endpoint...

CVE-2025-60298

CVE-2025-60298 affects Novel-Plus up to version 5.2.4, with a Stored XSS via the /author/updateIndexName endpoint. The indexName parameter is stored in the database and executed when other users view the affected book chapter, enabling authenticated attackers to inject JavaScript. CVSSv3.1 base s...