CVE-2025-36748

MediumCVSS 5.4/10Last modified Oct 7, 2026

Description

ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-36755.3A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function se CVE-2025-367505.4ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant CVE-2025-367519.4Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the net CVE-2025-367529.8Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level acce CVE-2025-367539.8The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access CVE-2025-367549.3The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post CVE-2025-367552.4The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating co CVE-2025-367565.8A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is CVE-2025-367576.3It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen CVE-2025-367586.3It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality CVE-2025-367598.7Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user em CVE-2025-36769.8A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/searc