cbcvebase.

Fortinet Fortisandbox vulnerabilities

65 known vulnerabilities affecting fortinet/fortisandbox.

Total CVEs
65
CISA KEV
2
actively exploited
Public exploits
2
Exploited in wild
3
Severity breakdown
CRITICAL8HIGH25MEDIUM30LOW2

Vulnerabilities

Page 3 of 4
CVE-2023-47541P4MEDIUMCVSS 6.7≥ 2.0.0, < 4.2.7≥ 4.4.0, < 4.4.3+12 more2024-04-09
CVE-2023-47541 [MEDIUM] CWE-22 CVE-2023-47541: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in F An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all
nvd
CVE-2025-46215P3MEDIUMCVSS 5.3≥ 4.0.0, < 4.4.8≥ 5.0.0, < 5.0.2+4 more2025-11-18
CVE-2025-46215 [MEDIUM] CWE-653 CVE-2025-46215: An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file.
nvd
CVE-2026-106172P4MEDIUMCVSS 5.3≥ 5.2.0, ≤ 5.2.1≥ 5.0.0, ≤ 5.0.6+1 more2026-10-13
CVE-2026-106172 [MEDIUM] CWE-321 CVE-2026-106172: A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, Fo A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HT
nvd
CVE-2021-32591P4MEDIUMCVSS 5.3≥ 3.2.0, ≤ 3.2.2v4.0.02021-12-08
CVE-2021-32591 [MEDIUM] CVE-2021-32591: A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS cre A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
nvd
CVE-2020-29013P4MEDIUMCVSS 5.4≤ 3.1.4v3.2.0+1 more2022-04-06
CVE-2020-29013 [MEDIUM] CWE-20 CVE-2020-29013: An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests.
nvd
CVE-2023-41680P4MEDIUMCVSS 6.1≥ 2.5.0, ≤ 2.5.2≥ 3.0.0, ≤ 3.0.7+7 more2023-10-13
CVE-2023-41680 [MEDIUM] CWE-79 CVE-2023-41680: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox
nvd
CVE-2021-24014P4MEDIUMCVSS 6.1≤ 3.1.4≥ 3.2.0, < 3.2.32021-08-04
CVE-2021-24014 [MEDIUM] CWE-79 CVE-2021-24014: Multiple instances of improper neutralization of input during web page generation vulnerabilities in Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via specifically crafted request parameters.
nvd
CVE-2023-41836P4MEDIUMCVSS 6.1≥ 3.0.4, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.5+5 more2023-10-13
CVE-2023-41836 [MEDIUM] CWE-79 CVE-2023-41836: An improper neutralization of input during web page generation ('cross-site scripting') vulnerabilit An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands v
nvd
CVE-2023-41681P4MEDIUMCVSS 6.1≥ 2.5.0, ≤ 2.5.2≥ 3.0.0, ≤ 3.0.7+7 more2023-10-13
CVE-2023-41681 [MEDIUM] CWE-79 CVE-2023-41681: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox
nvd
CVE-2020-29012P4MEDIUMCVSS 5.3fixed in 3.2.22021-09-08
CVE-2020-29012 [MEDIUM] CWE-613 CVE-2020-29012: An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
nvd
CVE-2025-61886P4MEDIUMCVSS 5.4≥ 5.0.0, < 5.0.5≥ 5.0.0, ≤ 5.0.42026-04-14
CVE-2025-61886 [MEDIUM] CWE-79 CVE-2025-61886: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilit An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow an attacker to perform an XSS attack via crafted HTTP requests.
nvd
CVE-2023-41843P4MEDIUMCVSS 5.4≥ 2.5.0, ≤ 2.5.2≥ 3.0.0, ≤ 3.0.7+7 more2023-10-13
CVE-2023-41843 [MEDIUM] CWE-79 CVE-2023-41843: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox
nvd
CVE-2023-45587P4MEDIUMCVSS 5.4≥ 3.1.0, ≤ 3.1.5≥ 3.2.0, ≤ 3.2.4+7 more2023-12-13
CVE-2023-45587 [MEDIUM] CWE-79 CVE-2023-45587: An improper neutralization of input during web page generation ('cross-site scripting') vulnerabilit An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions allows attacker to execute unauthorized code or commands via crafted HTTP request
nvd
CVE-2020-29014P4MEDIUMCVSS 5.3fixed in 3.2.22021-07-09
CVE-2020-29014 [MEDIUM] CWE-362 CVE-2020-29014: A concurrent execution using shared resource with improper synchronization ('race condition') in the A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands.
nvd
CVE-2026-106170P4MEDIUMCVSS 4.9≥ 5.2.0, ≤ 5.2.1≥ 5.0.0, ≤ 5.0.6+1 more2026-10-13
CVE-2026-106170 [MEDIUM] CWE-248 CVE-2026-106170: An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5 An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
nvd
CVE-2023-41844P4MEDIUMCVSS 5.4≥ 3.0.0, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.5+9 more2023-12-13
CVE-2023-41844 [MEDIUM] CWE-79 CVE-2023-41844: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 and above allows attacker to execute unauthorized code or comm
nvd
CVE-2018-1356P4MEDIUMCVSS 6.1fixed in 3.0.0v2.5.2+4 more2019-04-09
CVE-2018-1356 [MEDIUM] CWE-79 CVE-2018-1356: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow a A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component.
nvd
CVE-2025-53608P4MEDIUMCVSS 4.8≥ 4.0.0, < 4.4.8≥ 5.0.0, < 5.0.3+4 more2026-03-10
CVE-2025-53608 [MEDIUM] CWE-79 CVE-2025-53608: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilit An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests.
nvd
CVE-2020-15939P4MEDIUMCVSS 4.3fixed in 3.1.5≥ 3.2.0, < 3.2.22021-09-06
CVE-2020-15939 [MEDIUM] CVE-2020-15939: An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1. An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL.
nvd
CVE-2026-39812P4MEDIUMCVSS 4.8≥ 4.2.0, ≤ 4.2.8≥ 4.4.0, < 4.4.9+4 more2026-04-14
CVE-2026-39812 [MEDIUM] CWE-79 CVE-2026-39812: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all versions may allow attacker to execu
nvd
← Previous3 / 4Next →