CVE-2025-36750

MediumCVSS 5.4

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

ShineLan-X contains a stored cross-site scripting (XSS) vulnerability in the Plant Name field. An HTML payload will be displayed on the plant management page via a direct post, which may allow attackers to force a legitimate user's browser's JavaScript engine to run malicious code.

Risk Assessment

An attacker could execute malicious code in a user's browser, potentially leading to data theft, session hijacking, or other harmful actions.

Recommendation

Sanitize input in the Plant Name field and update ShineLan-X to a patched version.

Other vulnerabilities in ShineLan-X

CVE-2025-36748Medium
ShineLan-X contains a stored cross-site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module's settings center, which may allow attackers to force a legitimate user's browser's JavaScript engine to run malicious code.

Original NVD description (English source)

ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS