Vendor
Xxyopen Novel version 3.5.0 contains a DOM-based Cross-Site Scripting vulnerability in its comment module, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions.