CVE-2025-61886 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2025-61886

Analyzed

More Info Official Page

Source-psirt@fortinet.com

Published At-14 Apr, 2026 | 16:16

Updated At-22 Apr, 2026 | 19:09

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow an attacker to perform an XSS attack via crafted HTTP requests.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CPE Matches

>>fortisandbox>>Versions from 5.0.0(inclusive) to 5.0.5(exclusive)

cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*

>>fortisandbox_cloud>>5.0.4

cpe:2.3:a:fortinet:fortisandbox_cloud:5.0.4:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	psirt@fortinet.com

CWE ID: CWE-79

Type: Primary

Source: psirt@fortinet.com

References

Hyperlink	Source	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-109	psirt@fortinet.com	Vendor Advisory

Hyperlink: https://fortiguard.fortinet.com/psirt/FG-IR-26-109

Source: psirt@fortinet.com

Resource:

Vendor Advisory