CVE-2019-15706 MEDIUM

CVE-2019-15706

Vendor Fortinet
Product FortiProxy
Weakness CWE-79 · XSS
Published March 17, 2025
Last update March 17, 2025
View on NVD All CVEs

CVSS base score

4.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:F/RL:X/RC:X

What the vulnerability does

01Description

An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6.2.1 and below, version 6.0.8 and below, version 5.6.12 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS).

Key dates

02Disclosure timeline

March 17, 2025 CVE published
March 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-59773 Multiple vulnerabilities in AndSoft's e-TMS CVE-2022-1819 Student Information System Student Roll Module cross site scripting CVE-2025-15064 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CVE-2023-4726 Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings CVE-2025-66501 Foxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text Feature