CVE-2025-61886: Fortinet FortiSandbox

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow an attacker to perform an XSS attack via crafted HTTP requests.

Affected products

• Fortinet FortiSandbox: from 5.0.0, before 5.0.5 (fixed in 5.0.5)
• Fortinet FortiSandbox Cloud: version 5.0.4 only

Published 2026-04-14. Last modified 2026-06-17.