Wandsoft · Andsoft E-Tms · CVE-2025-59758
**Name of the Vulnerable Software and Affected Versions**
AndSoft e-TMS version 25.03
**Description**
A cross-site scripting (XSS) issue exists that allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a malicious URL. The vulnerability is reflected in the `/clt/LOGINFRM CYLOG.ASP` API endpoint, specifically through the `l`, `demo`, `demo2`, `TNTLOGIN`, `UO`, and `SuppConn` parameters.
**Recommendations**
Apply a fix for AndSoft e-TMS version 25.03 to address the cross-site scripting issue. As a temporary workaround, sanitize all input received through the `l`, `demo`, `demo2`, `TNTLOGIN`, `UO`, and `SuppConn` parameters in the `/clt/LOGINFRM CYLOG.ASP` endpoint.