CVE-2025-36748
Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X
- State
- Published
- Severity
- 8.4 High
- Published
- Dec 13, 2025
- Updated
- Dec 16, 2025
- Reserved
- Apr 15, 2025
Description
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L | DIVD |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
ShineLan-XGrowatt |
|
References
- https://csirt.divd.nl/CVE-2025-36748/third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.