CVE-2023-41836 LOW

CVE-2023-41836

Vendor Fortinet
Product FortiSandbox
Weakness CWE-79 · XSS
Published October 13, 2023
Last update January 14, 2026
View on NVD All CVEs

CVSS base score

3.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:C

What the vulnerability does

01Description

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands via crafted HTTP requests.

Key dates

02Disclosure timeline

October 13, 2023 CVE published
January 14, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-43151 WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerability CVE-2024-21729 [20240701] - Core - XSS in accessible media selection field CVE-2026-4852 Image Source Control Lite – Show Image Credits and Captions <= 3.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field CVE-2025-9716 O2OA Personal Profile form cross site scripting CVE-2025-57998 WordPress E-namad & Shamed Logo Manager Plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability