CVE-2025-36748: Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36748?
CVE-2025-36748 is classified as a high-severity stored cross site scripting (XSS) vulnerability.
How do I fix CVE-2025-36748?
To fix CVE-2025-36748, sanitize and validate user inputs in the local configuration web server to prevent unauthorized JavaScript code insertion.
What software is affected by CVE-2025-36748?
The affected software for CVE-2025-36748 is Growatt ShineLan-X.
What risks are associated with CVE-2025-36748?
The risks associated with CVE-2025-36748 include potential exploitation by attackers to execute arbitrary JavaScript in the context of a user’s browser.
How can I mitigate the impact of CVE-2025-36748?
To mitigate CVE-2025-36748, implement proper input validation techniques and ensure the application updates are applied regularly.