cbcvebase.

Fortinet Fortiweb vulnerabilities

124 known vulnerabilities affecting fortinet/fortiweb.

Total CVEs
124
CISA KEV
4
actively exploited
Public exploits
5
Exploited in wild
7
Severity breakdown
CRITICAL15HIGH49MEDIUM57LOW3

Vulnerabilities

Page 3 of 7
CVE-2024-50567P3HIGHCVSS 7.2≥ 7.0.0, < 7.4.6v7.6.0+1 more2025-02-11
CVE-2024-50567 [HIGH] CWE-78 CVE-2024-50567: An improper neutralization of special elements used in an os command ('os command injection') in For An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input.
nvd
CVE-2025-64471P3HIGHCVSS 7.5≥ 7.0.0, ≤ 7.0.11≥ 7.2.0, ≤ 7.2.11+3 more2025-12-09
CVE-2025-64471 [HIGH] CWE-836 CVE-2025-64471: A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenti
nvd
CVE-2023-23777P3HIGHCVSS 7.2≥ 6.3.6, ≤ 6.3.18≥ 6.4.0, ≤ 6.4.3+3 more2023-07-11
CVE-2023-23777 [HIGH] CWE-78 CVE-2023-23777: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulner An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters.
nvd
CVE-2020-29018P3HIGHCVSS 8.8≥ 6.3.0, ≤ 6.3.52021-01-14
CVE-2020-29018 [HIGH] CWE-134 CVE-2020-29018: A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote att A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.
nvd
CVE-2021-42753P3HIGHCVSS 8.1≥ 5.8.0, < 6.3.16≥ 6.4.0, < 6.4.22022-02-02
CVE-2021-42753 [HIGH] CWE-22 CVE-2021-42753: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in the device filesystem.
nvd
CVE-2023-34984P3HIGHCVSS 8.8≥ 6.3.6, ≤ 6.3.23≥ 6.4.0, ≤ 6.4.3+2 more2023-09-13
CVE-2023-34984 [HIGH] CWE-693 CVE-2023-34984: A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
nvd
CVE-2022-43948P3HIGHCVSS 7.8≥ 7.0.0, < 7.0.4≥ 7.0.0, ≤ 7.0.32023-04-11
CVE-2022-43948 [HIGH] CWE-78 CVE-2022-43948: A improper neutralization of special elements used in an os command ('os command injection') in Fort A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions, FortiADC 5.4 all versions, FortiADC 5.3 all versions,
nvd
CVE-2024-26013P3HIGHCVSS 7.5≥ 7.4.0, < 7.4.32025-04-08
CVE-2024-26013 [HIGH] CWE-923 CVE-2024-26013: A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in For A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 thr
nvd
CVE-2024-55597P3HIGHCVSS 7.2≥ 7.0.0, < 7.4.6v7.6.0+3 more2025-03-11
CVE-2024-55597 [HIGH] CWE-22 CVE-2024-55597: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWe A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests.
nvd
CVE-2024-50565P3HIGHCVSS 7.5≥ 7.4.0, < 7.4.3≥ 7.4.0, ≤ 7.4.2+2 more2025-04-08
CVE-2024-50565 [HIGH] CWE-300 CVE-2024-50565: A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in For A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, For
nvd
CVE-2025-25254P3HIGHCVSS 7.2≥ 7.0.0, < 7.4.7≥ 7.6.0, < 7.6.3+4 more2025-04-08
CVE-2025-25254 [HIGH] CWE-22 CVE-2025-25254: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.
nvd
CVE-2024-45324P3HIGHCVSS 7.2≥ 7.0.0, < 7.0.11≥ 7.2.0, < 7.2.11+5 more2025-03-11
CVE-2024-45324 [HIGH] CWE-134 CVE-2024-45324: A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 throug A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 t
nvd
CVE-2022-29059P3HIGHCVSS 7.2≥ 6.2.3, ≤ 6.2.7≥ 6.3.0, ≤ 6.3.18+3 more2025-03-14
CVE-2022-29059 [HIGH] CWE-89 CVE-2022-29059: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerabilit An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters.
nvd
CVE-2026-24640P3MEDIUMCVSS 6.6≥ 7.0.2, ≤ 7.0.12≥ 7.2.0, < 7.6.7+5 more2026-03-10
CVE-2026-24640 [MEDIUM] CWE-121 CVE-2026-24640: A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 throu A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0.2 through 7.0.12 may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via cr
nvd
CVE-2024-46671P3HIGHCVSS 7.2≥ 7.0.0, < 7.2.11≥ 7.4.0, < 7.4.7+5 more2025-04-08
CVE-2024-46671 [HIGH] CWE-286 CVE-2024-46671: An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7. An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.
nvd
CVE-2026-30897P3MEDIUMCVSS 6.6≥ 7.0.0, < 7.4.12≥ 7.6.0, < 7.6.7+6 more2026-03-10
CVE-2026-30897 [MEDIUM] CWE-121 CVE-2026-30897: A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
nvd
CVE-2022-40683P3HIGHCVSS 7.8≥ 7.0.0, ≤ 7.0.32023-02-16
CVE-2022-40683 [HIGH] CWE-415 CVE-2022-40683: A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauth A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands
nvd
CVE-2022-33871P3HIGHCVSS 7.2≥ 6.3.6, < 6.3.20v6.4.0+7 more2023-02-16
CVE-2022-33871 [HIGH] CWE-121 CVE-2022-33871: A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI `execute backup-local rename` and `execute backup-local show` operations.
nvd
CVE-2021-36193P3HIGHCVSS 7.2≥ 5.0.0, < 6.2.6≥ 6.3.0, < 6.3.16+3 more2022-02-02
CVE-2021-36193 [HIGH] CWE-121 CVE-2021-36193: Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may a Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
nvd
CVE-2025-22254P3HIGHCVSS 7.2≥ 7.4.0, < 7.4.7≥ 7.6.0, < 7.6.2+2 more2025-06-10
CVE-2025-22254 [HIGH] CWE-269 CVE-2025-22254: An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 thr An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6
nvd
← Previous3 / 7Next →