FortiWeb - Authentication Bypass

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTT...

fortiweb-auth-bypass-check

FortiWeb 인증 우회 점검 Bishop Fox의 FortiWeb 인증 우회 스캐너 대상이 인증 우회 CVE-2025-64446에 취약한지 테스트합니다. 경로 탐색path traversal만 악용하며 실제 인증 우회는 악용하지 않습니다. 대상에 대해 어떠한 관리 작업도 수행하지 않습니다. 이 취약점에 대한 자세한 내용은 Bishop Fox 블로그를 참조하세요. 설치 root@kitploit: git clone https://github.com/BishopFox/fortiweb-auth-bypass-check cd...

FortiWeb-cve-2025-64446-RCE-exploit

FortiWeb CVE-2025-64446 RCE 익스플로잇 전문 보안 연구 및 취약점 평가 프레임워크 설치 · 빠른 시작 · 사용법 · 아키텍처 · CLI 참조 · 고지 개요 FortiWeb Research Tool은 FortiWeb 웹 애플리케이션 방화벽 어플라이언스에 영향을 주는 치명적인 사전 인증 원격 코드 실행 문제인 CVE-2025-64446 에 대한 승인된 탐지 및 분석을 위한 Python 평가 프레임워크입니다...

CVE-2025-64446-

CVE-2025-64446-...

BELL-CVE-2026-64446

Bulletin has no description...

📄 FortiWeb 8.0.1 Authentication Bypass / Code Execution

This Metasploit module targets a critical remote code execution vulnerability in FortiWeb's management interface by chaining multiple weaknesses. It goes from authentication bypass to path traversal to arbitrary file upload to remote code execution...

📄 FortiWeb 8.0.1 Remote Code Execution

FortiWeb remote code execution exploit that affects versions prior to 7.6.7, 7.8.7, and 8.0.2. Exploit Title: FortiWeb 8.0.2 - Remote Code Execution Date: 2025-11-22 Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Vendor...

FortiWeb 8.0.2 - Remote Code Execution

Exploit Title: FortiWeb 8.0.2 - Remote Code Execution Date: 2025-11-22 Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Vendor Homepage: https://www.fortinet.com Software Link:...

Fortinet FortiWeb v8.0.1 - Auth Bypass

Titles:Fortinet FortiWeb v8.0.1 - Auth Bypass Author: nu11secur1ty Date: 11/15/2025 Vendor: https://www.fortinet.com/ Software: v8.0.1 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-64446 Description: CVE-2025-64446 is a critical path traversal vulnerability affecting multiple versions of...

Exploit for Relative Path Traversal in Fortinet Fortiweb

🚨 CVE-2025-64446 – FortiWeb Vulnerability Research 🔥 Crit...

Fortinet Releases Security Advisory for Relative Path Traversal Vulnerability Affecting FortiWeb Products

CISA has updated this Alert to include an additional vulnerability, CVE-2025-58034, and its relation to CVE-2025-64446, and associated resources. CISA is aware of the exploitation of two vulnerabilities, CVE-2025-64446link is external and CVE-2025-58034link is external, in Fortinet FortiWeb, a we...

Metasploit Wrap-Up 11/21/2025

CVE-2025-64446 - Fortinet’s FortiWeb exploitation A critical vulnerability in Fortinet’s FortiWeb Web Application Firewall, now assigned CVE-2025-64446 CVSS 9.1, allows unauthenticated attackers to gain full administrator access to the FortiWeb Manager interface and its websocket CLI. The flaw...

Vulnerability fixed in Fortinet FortiWeb

Fortinet has fixed a vulnerability in FortiWeb. Fortinet has fixed a vulnerability in FortiWeb. The vulnerability marked CVE-2025-64446 involves a relative path traversal vulnerability and allows an unauthenticated remote attacker to execute administrative commands via specially crafted HTTP...

Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild

A critical authentication bypass vulnerability affecting Fortinet FortiWeb web application firewalls has been actively exploited since early October 2025. The vulnerability allows unauthenticated attackers to create admin accounts and gain complete control over vulnerable devices exposed to the...

CVE-2025-64446

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTT...

CVE-2025-64446

creationtimestamp| type| source ---|---|--- 2025-11-14 15:42:34+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/fortinetfortiwebcreateadmin.rb 2025-11-14 16:02:10+00:00| seen|...

Fortinet FortiWeb Path Confusion in GUI (FG-IR-25-910)

The version of FortiWeb installed on the remote host is 7.0.x prior to 7.0.12, 7.2.x prior to 7.2.12, 7.4.x prior to 7.4.10, 7.6.x prior to 7.6.5, or 8.0.x prior to 8.0.2. It is, therefore, affected by a path confusion vulnerability as referenced in the FG-IR-25-910 advisory: - A relative path...

Fortinet FortiWeb unauthenticated RCE

This exploit module exploits an authentication bypass via path traversal vulnerability in the Fortinet FortiWeb management interface to create a new local administrator user account. From there a command injection vulnerability is leveraged to achieve RCE with root privileges. The auth bypass...

Microsoft Office Visio VISIODWG.DLL DXF File Handling Vulnerability

This module exploits a stack based overflow vulnerability in the handling of the DXF files by Microsoft Visio 2002. Revisions prior to the release of the MS bulletin MS10-028 are vulnerable. The overflow occurs when the application is used to import a specially crafted DXF file, while parsing the...