CVE-2025-36748

MediumCVSS 5.4

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

ShineLan-X contains a stored cross-site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module's settings center, which may allow attackers to force a legitimate user's browser's JavaScript engine to run malicious code.

Risk Assessment

An attacker could execute malicious code in a user's browser, potentially leading to data theft, session hijacking, or other harmful actions.

Recommendation

Sanitize input in the communication module's settings center and update ShineLan-X to a patched version.

Other vulnerabilities in ShineLan-X

CVE-2025-36750Medium
ShineLan-X contains a stored cross-site scripting (XSS) vulnerability in the Plant Name field. An HTML payload will be displayed on the plant management page via a direct post, which may allow attackers to force a legitimate user's browser's JavaScript engine to run malicious code.

Original NVD description (English source)

ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS