CVE-2025-53608

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53608
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-091 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
History

12 Mar 2026, 21:18

Type Values Removed Values Added
CPE cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
First Time Fortinet
Fortinet fortisandbox
Summary
  • (es) Una vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('cross-site scripting') [CWE-79] vulnerabilidad en Fortinet FortiSandbox 5.0.0 hasta 5.0.2, FortiSandbox 4.4.0 hasta 4.4.7, FortiSandbox 4.2 todas las versiones, FortiSandbox 4.0 todas las versiones puede permitir a un atacante privilegiado autenticado ejecutar código a través de solicitudes manipuladas.
References () https://fortiguard.fortinet.com/psirt/FG-IR-26-091 - () https://fortiguard.fortinet.com/psirt/FG-IR-26-091 - Vendor Advisory

10 Mar 2026, 18:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:17

Updated : 2026-03-12 21:18

NVD link : CVE-2025-53608

Mitre link : CVE-2025-53608

CVE.ORG link : CVE-2025-53608

JSON object : View

Products Affected

fortinet

  • fortisandbox
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')