FO
Product
FortiSandbox
On CISA KEVExploited in the wild
65
CVEs
2
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 8High 25Medium 30Low 2
Watch
Add FortiSandbox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25691 | 6.7 | Apr 14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8,… Affected: 5.0.0 through 5.0.5; 4.4.0 through 4.4.8; 4.2.1 through 4.2.8 |
| CVE-2024-27779 | 6.7 | Jul 18 | An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and… Affected: 4.4.0 through 4.4.4; 4.2.1 through 4.2.6; 4.0.0 through 4.0.6; 3.2.0 through 3.2.4 |
| CVE-2023-47540 | 6.7 | Apr 9 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1… Affected: 4.4.0 through 4.4.2; 4.2.1 through 4.2.6; 4.0.0 through 4.0.6; 3.2.0 through 3.2.4; 3.0.5 through 3.0.7 |
| CVE-2023-47541 | 6.7 | Apr 9 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6,… Affected: 4.4.0 through 4.4.2; 4.2.1 through 4.2.6; 4.0.0 through 4.0.6; 3.2.0 through 3.2.4; 3.1.0 through 3.1.5; 3.0.0 through 3.0.7; +6 more |
| CVE-2024-31490 | 6.5 | Sep 10 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all… Affected: 4.4.0 through 4.4.4; 4.2.1 through 4.2.6; 4.0.0 through 4.0.6; 3.2.2 through 3.2.4; 3.1.5 |
| CVE-2024-31487 | 6.5 | Apr 9 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6,… Affected: 4.4.0 through 4.4.4; 4.2.1 through 4.2.6; 4.0.0 through 4.0.6; 3.2.0 through 3.2.4; 3.1.0 through 3.1.5; 3.0.0 through 3.0.7; +2 more |
| CVE-2022-27485 | 6.5 | Apr 11 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0… Affected: 3.0.1 through 3.0.7; 3.1.0 before 3.2.4; 4.0.0 before 4.0.3; 4.2.0 |
| CVE-2021-24010 | 6.5 | Aug 4 | Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated user to obtain… Affected: 3.1.0 before 3.1.5; 3.2.0 before 3.2.3 |
| CVE-2025-54353 | 6.1 | Dec 9 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 5.0.0 through 5.0.2; 4.4.0 through 4.4.7; 4.2.1 through 4.2.8; 4.0.0 through 4.0.6 |
| CVE-2023-41836 | 6.1 | Oct 13 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4,… Affected: 3.0.4 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 4.0.0 through 4.0.4; 4.2.0 through 4.2.4; 4.4.0 |
| CVE-2023-41681 | 6.1 | Oct 13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through… Affected: 2.5.0 through 2.5.2; 3.0.0 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 4.0.0 through 4.0.3; 4.2.0 through 4.2.5; +2 more |
| CVE-2023-41680 | 6.1 | Oct 13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through… Affected: 2.5.0 through 2.5.2; 3.0.0 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 4.0.0 through 4.0.3; 4.2.0 through 4.2.5; +2 more |
| CVE-2021-24014 | 6.1 | Aug 4 | Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an… Affected: through 3.1.4; 3.2.0 before 3.2.3 |
| CVE-2018-1356 | 6.1 | Apr 9 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter… Affected: before 3.0.0 |
| CVE-2025-61886 | 5.4 | Apr 14 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4,… Affected: 5.0.0 through 5.0.4 |
| CVE-2023-41844 | 5.4 | Dec 13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions,… Affected: 4.4.0 through 4.4.2; 4.2.1 through 4.2.8; 4.0.0 through 4.0.6; 3.2.0 through 3.2.4; 3.1.0 through 3.1.5; 3.0.4 through 3.0.7 |
| CVE-2023-45587 | 5.4 | Dec 13 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions,… Affected: 4.4.0 through 4.4.2; 4.2.1 through 4.2.8; 4.0.0 through 4.0.6; 3.2.0 through 3.2.4; 3.1.0 through 3.1.5 |
| CVE-2023-41843 | 5.4 | Oct 13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through… Affected: 2.5.0 through 2.5.2; 3.0.0 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 4.0.0 through 4.0.3; 4.2.0 through 4.2.5; +2 more |
| CVE-2020-29013 | 5.4 | Apr 6 | An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically… Affected: through 3.1.4; 3.2.0; 3.2.1 |
| CVE-2026-106172 | 5.3 | Oct 13 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox… Affected: 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; 4.4.0 through 4.4.10 |
| CVE-2025-46215 | 5.3 | Nov 18 | An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all… Affected: 5.0.0 through 5.0.1; 4.4.0 through 4.4.7; 4.2.1 through 4.2.8; 4.0.0 through 4.0.6 |
| CVE-2021-32591 | 5.3 | Dec 8 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before… Affected: 3.2.0 through 3.2.2; 4.0.0 |
| CVE-2020-29012 | 5.3 | Sep 8 | An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information… Affected: before 3.2.2 |
| CVE-2020-29014 | 5.3 | Jul 9 | A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker… Affected: before 3.2.2 |
| CVE-2026-106170 | 4.9 | Oct 13 | An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow… Affected: 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; 4.4.0 through 4.4.10 |
| CVE-2026-39812 | 4.8 | Apr 14 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through… Affected: 5.0.0 through 5.0.4; 4.4.0 through 4.4.8; 4.2.1 through 4.2.8 |
| CVE-2025-53608 | 4.8 | Mar 10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 5.0.0 through 5.0.2; 4.4.0 through 4.4.7; 4.2.1 through 4.2.8; 4.0.0 through 4.0.6 |
| CVE-2024-54027 | 4.4 | Mar 17 | A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below,… Affected: 5.0.0; 4.4.0 through 4.4.6; 4.2.1 through 4.2.7; 4.0.0 through 4.0.5; 3.2.0 through 3.2.4; 3.1.0 through 3.1.5; +1 more |
| CVE-2020-15939 | 4.3 | Sep 6 | An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the… Affected: before 3.1.5; 3.2.0 before 3.2.2 |
| CVE-2022-22305 | 4.2 | Sep 1 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and… Affected: 3.0.0 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 3.0.1; 4.0.0; 4.0.1; +1 more |
Showing 30