Fortinet Fortiweb vulnerabilities

124 known vulnerabilities affecting fortinet/fortiweb.

Total CVEs
124
CISA KEV
4
actively exploited
Public exploits
4
Exploited in wild
0
Severity breakdown
CRITICAL15HIGH49MEDIUM57LOW3

Vulnerabilities

Page 2 of 7
CVE-2025-47857MEDIUMCVSS 6.7≥ 7.4.1, < 7.4.9≥ 7.6.0, < 7.6.4+2 more2025-08-12
CVE-2025-47857 [MEDIUM] CWE-78 CVE-2025-47857: A improper neutralization of special elements used in an os command ('os command injection') vulnera A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.
cvelistv5nvd
CVE-2025-32766MEDIUMCVSS 6.7≥ 7.4.1, < 7.4.9≥ 7.6.0, < 7.6.4+2 more2025-08-12
CVE-2025-32766 [MEDIUM] CWE-121 CVE-2025-32766: A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands
cvelistv5nvd
CVE-2025-25257CRITICALCVSS 9.8KEVPoC≥ 7.0.0, < 7.0.11≥ 7.2.0, < 7.2.11+6 more2025-07-17
CVE-2025-25257 [CRITICAL] CWE-89 CVE-2025-25257: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerabilit An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted
cvelistv5nvd
CVE-2025-22254HIGHCVSS 7.2≥ 7.4.0, < 7.4.7≥ 7.6.0, < 7.6.2+2 more2025-06-10
CVE-2025-22254 [HIGH] CWE-269 CVE-2025-22254: An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 thr An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6
cvelistv5nvd
CVE-2024-46671HIGHCVSS 7.2≥ 7.0.0, < 7.2.11≥ 7.4.0, < 7.4.7+5 more2025-04-08
CVE-2024-46671 [HIGH] CWE-286 CVE-2024-46671: An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7. An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.
cvelistv5nvd
CVE-2025-25254HIGHCVSS 7.2≥ 7.0.0, < 7.4.7≥ 7.6.0, < 7.6.3+4 more2025-04-08
CVE-2025-25254 [HIGH] CWE-22 CVE-2025-25254: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.
cvelistv5nvd
CVE-2024-50565HIGHCVSS 7.5≥ 7.4.0, < 7.4.3≥ 7.4.0, ≤ 7.4.2+2 more2025-04-08
CVE-2024-50565 [HIGH] CWE-300 CVE-2024-50565: A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in For A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, For
cvelistv5nvd
CVE-2024-26013HIGHCVSS 7.5≥ 7.4.0, < 7.4.32025-04-08
CVE-2024-26013 [HIGH] CWE-923 CVE-2024-26013: A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in For A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 thr
nvd
CVE-2023-25610CRITICALCVSS 9.8≥ 6.1.0, < 6.1.4≥ 6.2.0, < 6.2.8+10 more2025-03-24
CVE-2023-25610 [CRITICAL] CWE-124 CVE-2023-25610: A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet F A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5,
cvelistv5nvd
CVE-2024-55594CRITICALCVSS 9.8≥ 7.0.0, < 7.4.7≥ 7.4.0, ≤ 7.4.6+2 more2025-03-14
CVE-2024-55594 [CRITICAL] CWE-228 CVE-2024-55594: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
cvelistv5nvd
CVE-2022-29059HIGHCVSS 7.2≥ 6.2.3, ≤ 6.2.7≥ 6.3.0, ≤ 6.3.18+3 more2025-03-14
CVE-2022-29059 [HIGH] CWE-89 CVE-2022-29059: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerabilit An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters.
cvelistv5nvd
CVE-2023-42784CRITICALCVSS 9.8≥ 7.0.0, < 7.4.7≥ 7.4.0, ≤ 7.4.7+2 more2025-03-11
CVE-2023-42784 [CRITICAL] CWE-228 CVE-2023-42784: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
cvelistv5nvd
CVE-2024-45324HIGHCVSS 7.2≥ 7.0.0, < 7.0.11≥ 7.2.0, < 7.2.11+5 more2025-03-11
CVE-2024-45324 [HIGH] CWE-134 CVE-2024-45324: A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 throug A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 t
cvelistv5nvd
CVE-2024-55597HIGHCVSS 7.2≥ 7.0.0, < 7.4.6v7.6.0+3 more2025-03-11
CVE-2024-55597 [HIGH] CWE-22 CVE-2024-55597: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWe A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests.
cvelistv5nvd
CVE-2024-50569HIGHCVSS 7.2≥ 7.0.0, < 7.4.6v7.6.0+3 more2025-02-11
CVE-2024-50569 [HIGH] CWE-78 CVE-2024-50569: A improper neutralization of special elements used in an os command ('os command injection') in Fort A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input.
cvelistv5nvd
CVE-2024-50567HIGHCVSS 7.2≥ 7.0.0, < 7.4.6v7.6.0+1 more2025-02-11
CVE-2024-50567 [HIGH] CWE-78 CVE-2024-50567: An improper neutralization of special elements used in an os command ('os command injection') in For An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input.
cvelistv5nvd
CVE-2024-48885CRITICALCVSS 9.1≥ 6.4.0, < 7.4.5v7.6.0+4 more2025-01-16
CVE-2024-48885 [CRITICAL] CWE-22 CVE-2024-48885: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fo A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWe
cvelistv5nvd
CVE-2024-48884CRITICALCVSS 9.1≥ 6.4.0, < 7.4.5v7.6.02025-01-14
CVE-2024-48884 [CRITICAL] CWE-22 CVE-2024-48884: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fo A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, Fo
nvd
CVE-2024-21758MEDIUMCVSS 6.7≥ 7.2.0, < 7.2.8≥ 7.4.0, < 7.4.2+2 more2025-01-14
CVE-2024-21758 [MEDIUM] CWE-121 CVE-2024-21758: A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7 A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially crafted CLI commands, provided the user is able to evade FortiWeb stack protections.
cvelistv5nvd
CVE-2024-55593LOWCVSS 2.7≥ 6.3.6, < 7.6.2≥ 7.6.0, ≤ 7.6.1+5 more2025-01-14
CVE-2024-55593 [LOW] CWE-89 CVE-2024-55593: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet F A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 allows attacker to gain information disclosure via crafted SQL queries
cvelistv5nvd
← Previous2 / 7Next →