Skip to content
fr Sign in
4.1 Medium

CVE-2026-25972 An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet…

Description

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4 may allow a remote unauthenticated attacker to provide arbitrary data enabling a social engineering attack via spoofed URL parameters.

Affected products and versions

Product Affected versions Fixed in
FortiSIEM 7.4.0 No fix stated
FortiSIEM 7.3 7.3.0 → 7.3.4 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiSIEM

The 26 CVEs of FortiSIEM →
CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM… 9.4 Critical CVE-2026-106176 A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or… 3.4 Low CVE-2026-84389 A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM… 2.8 Low CVE-2026-70467 A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM… 3.4 Low
Track this CVE