CVE-2019-5590

6.1 mediumEPSS 1.0%

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-08-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiweb

References

http://www.securityfocus.com/bid/108786
https://fortiguard.com/advisory/FG-IR-19-070
http://www.securityfocus.com/bid/108786
https://fortiguard.com/advisory/FG-IR-19-070

Check your stack JSON