Description
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiSandbox | 5.0.0 – ≤ 5.0.5, 4.4.0 – ≤ 4.4.8, 4.2.1 – ≤ 4.2.8 | — |
| Fortinet | FortiSandbox Cloud | 5.0.4 – ≤ 5.0.5 | — |
| Fortinet | FortiSandbox PaaS | 5.0.4 – ≤ 5.0.5 | — |
Advisories 1
- NCSC-2026-0483 Kwetsbaarheid verholpen in Fortinet FortiSandbox NCSC-NL (Netherlands) · Nov 11, 2026