PT-2025-6944 · Unishippers · Ltl Freight Quotes – Unishippers Edition
Trương Hữu Phúc
·
Published
2025-02-16
·
Updated
2025-02-18
·
CVE-2025-22284
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
LTL Freight Quotes – Unishippers Edition versions 2.5.8 and earlier
Description:
The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting (XSS). This problem enables attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data theft. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.
Recommendations:
For versions 2.5.8 and earlier, update to a version later than 2.5.8 to resolve the issue. As a temporary workaround, consider restricting input validation to minimize the risk of exploitation. Avoid using vulnerable parameters in affected API endpoints until the issue is resolved. At the moment, there is no additional information about other mitigation measures.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ltl Freight Quotes – Unishippers Edition