CVE-2018-9186

A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header.

• CWE-79

• http://www.securityfocus.com/bid/104371Third Party Advisory, VDB Entry
• https://fortiguard.com/advisory/FG-IR-18-059Vendor Advisory
• http://www.securityfocus.com/bid/104371Third Party Advisory, VDB Entry
• https://fortiguard.com/advisory/FG-IR-18-059Vendor Advisory

Published

May 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9174sys_verifies.php in DedeCMS 5.7 allows remote attackers to e…
• CVE-2018-9175DedeCMS 5.7 allows remote attackers to execute arbitrary PHP…
• CVE-2018-9177Twonky Server before 8.5.1 has XSS via a folder name on the …
• CVE-2018-9182Twonky Server before 8.5.1 has XSS via a modified "language"…
• CVE-2018-9183The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has …
• CVE-2018-9185An information disclosure vulnerability in Fortinet FortiOS …
• CVE-2018-9190A null pointer dereference vulnerability in Fortinet FortiCl…
• CVE-2018-9191A local privilege escalation in Fortinet FortiClient for Win…
• CVE-2018-9192A plaintext recovery of encrypted messages or a Man-in-the-m…
• CVE-2018-9193A researcher has disclosed several vulnerabilities against F…7.8
• CVE-2018-9194A plaintext recovery of encrypted messages or a Man-in-the-m…
• CVE-2018-9195Use of a hardcoded cryptographic key in the FortiGuard servi…5.9