PT-2025-6945 · Enituretechnology · Enituretechnology Ltl Freight Quotes – Worldwide Express Edition
Trương Hữu Phúc
·
Published
2025-02-16
·
Updated
2025-02-18
·
CVE-2025-22286
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
enituretechnology LTL Freight Quotes – Worldwide Express Edition versions n/a through 5.0.21
Description:
The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting (XSS). This enables attackers to inject malicious scripts into websites, potentially leading to unauthorized access or data theft. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.
Recommendations:
For versions n/a through 5.0.21, update to a version later than 5.0.21 to resolve the issue. As a temporary workaround, consider restricting access to sensitive pages or inputs that may be vulnerable to Cross-site Scripting attacks until a patch is available. Avoid using potentially vulnerable API endpoints or parameters that may be susceptible to XSS attacks. At the moment, there is no additional information about other mitigation measures.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Enituretechnology Ltl Freight Quotes – Worldwide Express Edition