CVE-2025-52436
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.
Severity
High 7.9
CVSS 3.1
Exploited
Not listed
EPSS
0.065
93.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
Feb 10, 2026
Assigned by fortinet
Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.
Weakness: CWE-79
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiSandbox
Credit
Internally reported and discovered by Jaguar Perlas of Burnaby Infosec team.
Vendor remediation
Upgrade to FortiSandbox version 5.0.2 or above Upgrade to FortiSandbox version 4.4.8 or above