An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site scripting attack (XSS) via injecting malicious payloads in different locations.
References
| Link | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-20-137 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Jul 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fortinet:fortiwlc:8.6.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiwlc:8.3.3:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Fortinet fortiwlc
Fortinet |
|
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-20-137 - Vendor Advisory |
17 Mar 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-17 14:15
Updated : 2025-07-24 20:16
NVD link : CVE-2021-26087
Mitre link : CVE-2021-26087
JSON object : View
Products Affected
fortinet
- fortiwlc
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')