CVE-2025-53608

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Fortinet	FortiSandbox	>= 5.0.0, <= 5.0.2; >= 4.4.0, <= 4.4.7; >= 4.2.1, <= 4.2.8; >= 4.0.0, <= 4.0.6

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-091Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-536094.9A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7 CVE-2025-53619.8A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. This issue affects som CVE-2025-536189.1An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DI CVE-2025-536199.1An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DI CVE-2025-53629.8A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown func CVE-2025-536209.2@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the CVE-2025-536216.9DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity CVE-2025-536225.2DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, an CVE-2025-536238.1The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary CVE-2025-5362410.0The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content CVE-2025-536258.7The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail CVE-2025-536266.1pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vu