CVE-2025-58412
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Fortinet FortiADC 8.0.0, 7.6.0 through 7.6.3, 7.4 all versions, and 7.2 all versions contain a basic XSS vulnerability due to improper neutralization of script-related HTML tags. An attacker may execute unauthorized code or commands via a crafted URL.
Risk Assessment
An attacker could use a crafted URL to execute unauthorized code or commands in the victim's browser context, potentially leading to session theft or other actions. This requires convincing a user to click a link.
Recommendation
Update FortiADC to a version containing the fix. Additionally, implement input validation and encoding and consider deploying a Content Security Policy.
Other vulnerabilities in FortiADC
See all- CVE-2025-54971Medium
Fortinet FortiADC (versions 7.4.0, 7.2, 7.1, 7.0, and 6.2) contains an exposure of sensitive information to an unauthorized actor vulnerability. An admin with read-only permission may obtain the external resources password via the product logs.
- CVE-2025-48839Medium
An out-of-bounds write vulnerability (CWE-787) in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, and 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
- CVE-2025-59921Medium
Fortinet FortiADC versions 7.4.0, 7.2.3 and below, 7.1.4 and below, 7.0 all versions, and 6.2 all versions have an exposure of sensitive information to an unauthorized actor vulnerability. An authenticated attacker can obtain sensitive data via crafted HTTP or HTTPS requests.
Original NVD description (English source)
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS