Fortinet FortiWeb
74 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-26035 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.11 ; … | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, For | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-70466 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.5 ; 7.4.0 – 7.4.13 ; … | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 al | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-40688 | 8.0.0 – 8.0.3 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.11 | An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWe | HIGH 7.2 | 6.4 % | ||
| CVE-2026-39811 | 8.0.0 – 8.0.3 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.12 ; … | A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all vers | MEDIUM 4.9 | 0.4 % | ||
| CVE-2026-39814 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.6 ; 7.4.1 – 7.4.13 ; … | Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6 | MEDIUM 6.7 | 0.1 % | ||
| CVE-2025-66178 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.11 ; … | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 throug | HIGH 7.2 | 1.7 % | ||
| CVE-2026-24641 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.12 ; … | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, For | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-24640 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.12 ; … | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, | MEDIUM 6.6 | 0.7 % | ||
| CVE-2026-24017 | 8.0.0 – 8.0.2 ; 7.6.0 – 7.6.5 ; 7.4.0 – 7.4.10 ; … | An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 | HIGH 8.1 | 0.8 % | ||
| CVE-2025-48840 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.12 ; … | An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-30897 | 8.0.0 – 8.0.3 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.11 ; … | A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7 | MEDIUM 6.6 | 0.7 % | ||
| CVE-2026-24858 | 8.0.0 – 8.0.3 ; 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.11 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7. | CRITICAL 9.8 | 87 % | KEV | |
| CVE-2025-59719 | 8.0.0 ; 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.9 | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t | CRITICAL 9.8 | 29 % | ||
| CVE-2025-64471 | 8.0.0 – 8.0.1 ; 7.6.0 – 7.6.5 ; 7.4.0 – 7.4.10 ; … | A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1 | HIGH 7.5 | 0.3 % | ||
| CVE-2025-64447 | 8.0.0 – 8.0.1 ; 7.6.0 – 7.6.5 ; 7.4.0 – 7.4.10 ; … | A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 throu | HIGH 8.1 | 8.4 % | ||
| CVE-2025-59669 | 7.6.0 ; 7.4.0 – 7.4.11 ; 7.2.0 – 7.2.12 ; … | A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 | MEDIUM 5.5 | 0.1 % | ||
| CVE-2025-58034 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.11 ; … | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin | HIGH 7.2 | 55 % | KEV | |
| CVE-2025-64446 | 8.0.0 – 8.0.1 ; 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.9 ; … | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 | CRITICAL 9.8 | 91 % | KEV | |
| CVE-2024-47569 | 7.6.0 ; 7.4.0 – 7.4.4 ; 7.2.0 – 7.2.13 ; … | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, | MEDIUM 4.3 | 0.5 % | ||
| CVE-2025-53609 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.11 ; … | A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7 | MEDIUM 4.9 | 11 % | ||
| CVE-2025-47857 | 7.6.0 – 7.6.3 ; 7.4.1 – 7.4.8 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI | MEDIUM 6.7 | 0.5 % | ||
| CVE-2025-27759 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.7 ; 7.2.0 – 7.2.10 ; … | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb ve | MEDIUM 6.7 | 0.4 % | ||
| CVE-2025-52970 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.7 ; 7.2.0 – 7.2.10 ; … | A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7. | HIGH 8.1 | 10 % | ||
| CVE-2025-32766 | 7.6.0 – 7.6.3 ; 7.4.1 – 7.4.8 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privile | MEDIUM 6.7 | 0.1 % | ||
| CVE-2025-25257 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.7 ; 7.2.0 – 7.2.10 ; … | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2025-22254 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.6 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, | HIGH 7.2 | 0.8 % | ||
| CVE-2024-50565 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.11 ; 7.0.0 – 7.0.11 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4. | HIGH 7.5 | 0.4 % | ||
| CVE-2024-46671 | 7.6.0 – 7.6.2 ; 7.4.0 – 7.4.6 ; 7.2.0 – 7.2.10 ; … | An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, | HIGH 7.2 | 0.4 % | ||
| CVE-2025-25254 | 7.6.0 – 7.6.2 ; 7.4.0 – 7.4.6 ; 7.2.0 – 7.2.11 ; … | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below | HIGH 7.2 | 17 % | ||
| CVE-2023-25610 | | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, vers | CRITICAL 9.8 | 18 % | ||
| CVE-2024-55594 | 7.4.0 – 7.4.6 ; 7.2.0 – 7.2.10 ; 7.0.0 – 7.0.10 | An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 | CRITICAL 9.8 | 0.5 % | ||
| CVE-2022-29059 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.3 ; 6.3.0 – 6.3.23 ; … | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and | HIGH 7.2 | 0.4 % | ||
| CVE-2024-45324 | 7.6.0 ; 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.10 ; … | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, ve | HIGH 7.2 | 0.7 % | ||
| CVE-2023-42784 | 7.4.0 – 7.4.7 ; 7.2.0 – 7.2.10 ; 7.0.0 – 7.0.10 | An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 a | CRITICAL 9.8 | 0.4 % | ||
| CVE-2024-55597 | 7.6.0 ; 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.10 ; … | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows at | HIGH 7.2 | 0.6 % | ||
| CVE-2024-50567 | 7.6.0 ; 7.4.0 – 7.4.5 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allow | HIGH 7.2 | 2.2 % | ||
| CVE-2024-50569 | 7.6.0 ; 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.10 ; … | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows | HIGH 7.2 | 1.8 % | ||
| CVE-2024-48885 | 7.6.0 ; 7.4.0 – 7.4.4 ; 7.2.0 – 7.2.12 ; … | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1 | CRITICAL 9.1 | 0.8 % | ||
| CVE-2024-21758 | 7.4.0 – 7.4.1 ; 7.2.0 – 7.2.7 | A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to exec | MEDIUM 6.7 | 0.2 % | ||
| CVE-2024-55593 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.6 ; 7.2.0 – 7.2.10 ; … | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 al | LOW 2.7 | 0.4 % | ||
| CVE-2024-36509 | 7.6.0 ; 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.10 ; … | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4 | MEDIUM 4.4 | 0.2 % | ||
| CVE-2024-33509 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.10 ; 6.4.0 – 6.4.3 ; … | An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all v | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-23665 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.7 ; 7.0.0 – 7.0.10 ; … | Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and b | HIGH 8.8 | 0.5 % | ||
| CVE-2024-23107 | 7.4.0 ; 7.2.0 – 7.2.4 ; 7.0.0 – 7.0.8 ; … | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, ve | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-46713 | 7.4.0 ; 7.2.0 – 7.2.5 ; 7.0.0 – 7.0.10 ; … | An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may al | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-34984 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.6 ; 6.4.0 – 6.4.3 ; … | A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allo | HIGH 8.8 | 0.7 % | ||
| CVE-2023-23777 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.3 ; 6.3.6 – 6.3.18 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0 | HIGH 7.2 | 1.3 % | ||
| CVE-2023-33305 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.6 ; 6.4.0 – 6.4.3 ; … | A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0. | MEDIUM 6.5 | 0.8 % | ||
| CVE-2022-43955 | 7.0.0 – 7.0.3 ; 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.21 ; … | An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3 | HIGH 8.0 | 0.6 % | ||
| CVE-2022-43948 | 7.0.0 – 7.0.3 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0. | HIGH 7.8 | 0.6 % | ||
| CVE-2022-22297 | 6.4.0 – 6.4.1 ; 6.3.0 – 6.3.17 ; 6.2.0 – 6.2.7 ; … | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb ver | MEDIUM 5.5 | 0.2 % | ||
| CVE-2022-39951 | 7.0.0 – 7.0.2 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.20 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0. | HIGH 8.8 | 1.7 % | ||
| CVE-2023-22636 | 7.0.0 – 7.0.4 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.21 | An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow | MEDIUM 6.6 | 0.2 % | ||
| CVE-2022-40683 | 7.0.0 – 7.0.3 | A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially cr | HIGH 7.8 | 0.2 % | ||
| CVE-2023-23778 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.21 ; … | A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions m | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-23779 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.19 | Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb ver | HIGH 8.8 | 1.3 % | ||
| CVE-2022-30306 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.19 | A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, ve | HIGH 8.8 | 1.0 % | ||
| CVE-2022-33871 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.19 | A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier ma | HIGH 7.2 | 0.9 % | ||
| CVE-2023-23781 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.19 | A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML s | HIGH 8.8 | 0.7 % | ||
| CVE-2023-23782 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.19 ; … | A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versi | HIGH 7.8 | 0.2 % | ||
| CVE-2023-23783 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 | A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to | HIGH 7.8 | 0.2 % | ||
| CVE-2023-23784 | 7.0.0 – 7.0.2 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.20 | A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-23780 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.19 | A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet For | HIGH 8.8 | 0.8 % | ||
| CVE-2023-25602 | 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.17 ; 6.2.0 – 6.2.6 ; … | A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earli | HIGH 7.8 | 0.2 % | ||
| CVE-2021-42756 | 6.4.0 – 6.4.1 ; 6.3.0 – 6.3.16 ; 6.2.0 – 6.2.6 ; … | Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and | CRITICAL 9.8 | 35 % | ||
| CVE-2021-42761 | 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.16 ; 6.2.0 – 6.2.6 ; … | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3. | CRITICAL 9.8 | 1.5 % | ||
| CVE-2022-30299 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.19 ; … | A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions | MEDIUM 5.0 | 0.5 % | ||
| CVE-2021-43074 | 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.16 ; 6.2.0 – 6.2.7 ; … | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions | MEDIUM 4.3 | 0.3 % | ||
| CVE-2022-30300 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.18 | A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authen | MEDIUM 6.5 | 0.8 % | ||
| CVE-2022-30303 | 7.0.0 – 7.0.1 ; 6.4.0 – 6.4.2 ; 6.3.0 – 6.3.19 | An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3. | HIGH 8.8 | 2.5 % | ||
| CVE-2022-42471 | 7.0.0 – 7.0.2 ; 6.4.0 – 6.4.2 ; 6.3.6 – 6.3.21 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 t | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-36193 | | Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achiev | HIGH 7.2 | 0.8 % | ||
| CVE-2021-42757 | | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated l | MEDIUM 6.7 | 0.5 % | ||
| CVE-2019-5590 | 6.0.2 and below | The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized c | MEDIUM 6.1 | 1.0 % |