← Back

CVE-2026-39812

nvd nist
Published: Apr 14, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Exploitability: 1.7 / Impact: 2.7
Source: psirt@fortinet.com (Secondary)

Description

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Affected (7)

Fortinet
2 products
Fortisandbox
Fortisandbox Cloud
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortisandbox
4.2.0 ≤ version ≤ 4.2.8
Fortisandbox
4.4.0 ≤ version < 4.4.9
Fortisandbox
5.0.0 ≤ version < 5.0.6
Fortinet
Fortisandbox Cloud
22.2.4134 ≤ version ≤ 23.1.4260
Fortisandbox Cloud
23.3.4329 ≤ version ≤ 24.1.4436
Fortisandbox Cloud
Version 5.0.4
Fortisandbox Cloud
Version 5.0.5

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.