1711 matches found
Fortinet FortiWeb 安全漏洞
Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A security vulnerability exists in Fortinet...
CVE-2025-64471: Use of Password Hash Instead of Password for Authentication
A use of password hash instead of password for authentication vulnerability CWE-836 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attack...
CVE-2025-64447: Reliance on Cookies without Validation and Integrity Checking
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute...
CVE-2025-59719: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message...
PT-2025-50129
Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 8.0.0 through 8.0.1 Fortinet FortiWeb versions 7.6.0 through 7.6.5 Fortinet FortiWeb versions 7.4.0 through 7.4.10 Fortinet FortiWeb versions 7.2.0 through 7.2.11 Fortinet FortiWeb versions 7.0.0 through 7.0.11...
PT-2025-50119
Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 7.4.0 through 7.4.9 Fortinet FortiWeb versions 7.6.0 through 7.6.4 Fortinet FortiWeb version 8.0.0 Description An improper verification of cryptographic signature exists in the SAML Response Message Handler. This can...
PT-2025-50130
Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 8.0.0 through 8.0.1 Fortinet FortiWeb versions 7.6.0 through 7.6.5 Fortinet FortiWeb versions 7.4.0 through 7.4.10 Fortinet FortiWeb versions 7.2.0 through 7.2.11 Fortinet FortiWeb versions 7.0.0 through 7.0.11...
Fortinet FortiWeb SSO Login Authentication Bypass (FG-IR-25-647)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-25-647 advisory. - An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0,... CVE-2025-59719 - A...
Fortinet Fortigate SSO Login Authentication Bypass (FG-IR-25-647)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-25-647 advisory. - An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0,... CVE-2025-59719 - ...
FortiWeb Authentication Bypass Artifact Generator
This script attempts to detect if FortiWeb is vulnerable to authentication bypass. FortiWeb versions below 8.0.2 are affected...
The vulnerability of FortiWeb web applications’ network firewalls, related to the use of strictly encrypted credentials, allows attackers to gain unauthorized access to protected information.
The vulnerability of FortiWeb web applications’ network firewalls is related to the use of strictly encrypted credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Metasploit Wrap-Up 11/28/2025
This week, we have added 10 new modules to Metasploit Framework including an SMB to MSSQL relay module, a remote code execution module targeting Fortinet software, additional 32-bit and 64-bit RISC-V payloads, and more. The SMB to MSSQL NTLM relay module allows users to open MSSQL sessions and ru...
📄 FortiWeb 8.0.1 Authentication Bypass
A critical authentication bypass vulnerability exists in FortiWeb web application firewalls that allows unauthenticated attackers to create administrative users via path traversal in the API endpoint. Version 8.0.1 is affected...
📄 Fortinet FortiWeb Unauthenticated Remote Code Execution
This Metasploit module exploits an authentication bypass via a path traversal vulnerability in the Fortinet FortiWeb management interface to create a new local administrator user account. From there a command injection vulnerability is leveraged to achieve remote code execution with root...
Fortinet Releases Security Advisory for Relative Path Traversal Vulnerability Affecting FortiWeb Products
CISA has updated this Alert to include an additional vulnerability, CVE-2025-58034, and its relation to CVE-2025-64446, and associated resources. CISA is aware of the exploitation of two vulnerabilities, CVE-2025-64446link is external and CVE-2025-58034link is external, in Fortinet FortiWeb, a we...
Exploit for CVE-2025-50834
OS Command Injection Vulnerability in Fortinet FortiWeb CVE-2...
Exploit for OS Command Injection in Fortinet Fortiweb
OS Command Injection Vulnerability in Fortinet FortiWeb CVE-2...
⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More
This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools. Many hid inside trusted apps, browser alerts, and software updates. Big firms like Microsoft, Salesforce, and Google had to react fast — stopping DDoS...
Metasploit Wrap-Up 11/21/2025
CVE-2025-64446 - Fortinet’s FortiWeb exploitation A critical vulnerability in Fortinet’s FortiWeb Web Application Firewall, now assigned CVE-2025-64446 CVSS 9.1, allows unauthenticated attackers to gain full administrator access to the FortiWeb Manager interface and its websocket CLI. The flaw...