CVE-2024-35280 MEDIUM

CVE-2024-35280

Vendor Fortinet
Product FortiDeceptor
Weakness CWE-79 · XSS
Published January 15, 2025
Last update February 4, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C

What the vulnerability does

01Description

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions, FortiDeceptor 3.3 all versions, FortiDeceptor 3.2 all versions, FortiDeceptor 3.1 all versions, FortiDeceptor 3.0 all versions may allow an attacker to perform a reflected cross-site scripting attack in the recovery endpoints

Key dates

02Disclosure timeline

January 15, 2025 CVE published
February 4, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-12590 WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CVE-2025-64548 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-55296 LibreNMS allows stored XSS in Alert Template name field CVE-2020-7809 Estsoft ALSong DOM-Based XSS Vulnerability CVE-2025-8874 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox