This vulnerability arises from improper neutralization of user input during web page generation, allowing attackers to inject and execute arbitrary scripts. Attackers could potentially run malicious code or commands within the context of the victim's browser, which can lead to credential theft, session hijacking, and other phishing‑style attacks. The weakness is identified as a cross‑site scripting issue (CWE‑79).

Fortinet FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, and all 4.2 releases, as well as FortiSandbox PaaS versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, and all 4.2 releases are impacted. Even the earliest 4.2 series is affected.

The CVSS base score of 4.3 indicates medium severity, and the absence of an EPSS score makes exploitation likelihood uncertain. It is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. Attackers would need to send crafted input to the vulnerable web form, which they can do remotely from the internet. Thus while the risk is moderate, timely patching is advised to prevent a potential denial of service or compromise through client‑side exploitation.