CVE-2025-36750

Medium · 5.4

CVSS

5.4

EPSS

0.2%

Published

Dec 13, 2025

CISA due date

—

The record

ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious code.

Affected packages

Ecosystem	Package	Introduced	Fixed