CVE-2025-58412
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all vers
Severity
Medium 4.2
CVSS 3.1
Exploited
Not listed
EPSS
0.002
6.8th percentile
Discovered by
Third party
Vendor advisory field
Published
Nov 19, 2025
Assigned by fortinet
Description
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.
Weakness: CWE-80
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiADC | Web & Application Security | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiADC
Credit
Fortinet is pleased to thank ShenkerGroup and Italian ACN (National Authority Cybersecurity) for reporting this vulnerability under responsible disclosure.
Vendor remediation
Upgrade to FortiADC version 8.0.1 or above Upgrade to FortiADC version 7.6.4 or above