CVE-2025-54353

MediumCVSS 6.1/10Last modified Oct 8, 2026

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
FortinetFortiSandbox>= 5.0.0, <= 5.0.2; >= 4.4.0, <= 4.4.7; >= 4.2.1, <= 4.2.8; >= 4.0.0, <= 4.0.6

References

Timeline

Published
Dec 9, 2025
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-54365.3A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing ofCVE-2025-543636.9Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signCVE-2025-543646.9Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs anCVE-2025-543657.5fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more.CVE-2025-543668.8FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, thCVE-2025-543686.8uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise CVE-2025-543699.3Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion frCVE-2025-54375.3A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-biCVE-2025-543708.7PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, aCVE-2025-543736.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnCVE-2025-543748.8Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerabiCVE-2025-543767.5Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not pro