Paper/Archive/CVE-2025-52436

CVE-2025-52436

Fortinet FortiSandbox — An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet…

EPSS 7%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 94.4.944 × 2018.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.

Affected

ProductAffectedFixed inSource

FortiSandbox5.0.0 – 5.0.1–CNA

FortiSandbox4.4.0 – 4.4.7–CNA

FortiSandbox4.2.1 – 4.2.8–CNA

FortiSandbox4.0.0 – 4.0.6–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

fortinet (CNA)7.9CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-25-093