Fortinet FortiWeb sqli (FG-IR-22-140)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-140 advisory. - An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb delet...

FortiWeb - SQL Injection in delete filter component

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb delete log filter component may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters...

Fortinet FortiWeb OS command injection due to direct input interpolation in API controllers (FG-IR-21-180)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-180 advisory. - A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 6.4....

The vulnerability of the command-line interface of FortiWeb web applications allows attackers to disclose protected information.

The vulnerability of the command-line interface of FortiWeb web applications is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information using debugging commands...

Vulnerability of the firmware verification process for FortiOS operating systems. The network interface layer of FortiWeb web applications, FortiSwitch Ethernet switches, and FortiProxy proxy servers allow a hacker to execute arbitrary code.

The vulnerabilities of the FortiOS firmware verification process, the FortiWeb network interface layer, the FortiSwitch Ethernet switches, and the FortiProxy proxy server are related to the exploitation of the buffer boundary. Exploiting these vulnerabilities allows an attacker operating remotely...

The vulnerability of the client library for TFTP in FortiOS operating systems, the network interface for web applications FortiWeb, and the proxy server FortiProxy allows a perpetrator to execute arbitrary code.

The vulnerability of the client library for TFTP in FortiOS operating systems, the network interface for web applications FortiWeb, and the proxy server FortiProxy are related to buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially...

PT-2025-11276

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.1 and below FortiWeb versions 6.4.2 and below FortiWeb versions 6.3.20 and below FortiWeb versions 6.2.7 and below Description: The issue is related to an improper neutralization of special elements used in an SQL comman...

CVE-2021-41026

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-41026

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-41026

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

Path traversal

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-41026

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-41026

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-41026

CVE-2021-41026 affects Fortinet FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15. A relative path traversal in the FortiWeb API controller could allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. The connected doc...

PT-2022-11355

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.0 through 6.3.15 FortiWeb versions 6.4.0 FortiWeb versions 6.4.1 Description A relative path traversal may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted w...

Fortinet FortiWeb 路径遍历漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A path traversal vulnerability exists in...

CVE-2021-41026: Improper Limitation of a Pathname to a Restricted Directory

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

Fortinet FortiWeb - Heap-based buffer overflows in API controller (FG-IR-21-160)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-160 advisory. - Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2022-19074)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. Versions prior to 6.4.2 contain a buffer...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2022-09243)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists that stems...