CVE-2025-52436
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.
Severity
High 7.9
CVSS 3.1
Exploited
Not listed
EPSS
0.063
92.9th percentile
Discovered by
Not disclosed
Published
Feb 10, 2026
Assigned by fortinet
Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.
Weakness: CWE-79
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiSandbox
Vendor remediation
Upgrade to FortiSandbox version 5.0.2 or above Upgrade to FortiSandbox version 4.4.8 or above