CVE Daily

CVE-2019-15706

An improper neutralization of input during web page generation in the SSL VPN po...

Medium CVSS 4.1

Overview

An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6.2.1 and below, version 6.0.8 and below, version 5.6.12 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS).

CWE: CWE-79 Published: 2025-03-17T14:15:15.107
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.1 (MEDIUM)
  • Detected tags: xss (tag impact: MODERATE)

Recommended actions:

  • Apply context-aware output encoding.
  • Enable Content-Security-Policy and HttpOnly/SameSite cookies.

Recommended tools

Tags