CVE-2021-24006

CVE-2021-24006 – FortiManager Improper Access Control Exploit PoC PoC Proof of Concept - Educational Use Only Exploit for improper access to SD-WAN Orchestrator in FortiManager, exploiting an access control flaw CWE-284. Description The vulnerability CVE-2021-24006 affects FortiManager versions...

Fortijump-Exploit-CVE-2024-47575

CVE-2024-47575 Fortinet FortiManager Unauthenticated Remote Code Execution AKA FortiJump CVE-2024-47575 See our blog post for technical details To begin, establish your ncat session: nc -lvvnp 80 Then, execute our detection artefact generator: python3 CVE-2024-47575.py --target 192.168.1.110...

CVE-2020-9289

Decrypt FortiManager configuration secrets CVE-2020-9289 CVE-2020-9289 and CVE-2019-6693 are related to the same default and hardcoded key. The only differences on the decryption routine implemented in FortiManager/FortiAnalyzer are: The IV handling all the 16 bytes are provided before the...

CVE-2021-24006-Fortimanager-Exploit

CVE-2021-24006 – FortiManager Improper Access Control Exploit PoC PoC Proof of Concept - Educational Use Only Exploit for improper access to SD-WAN Orchestrator in FortiManager, exploiting access control flaw CWE-284. Description The CVE-2021-24006 vulnerability affects FortiManager versions 6.4....

CVE-2023-42791_CVE-2024-23666

Fortimanager insufficient authorization checks CVE-2024-23666 and unrestricted file upload CVE-2023-42791 exploitation scripts Two exploitation scripts leveraging these vulnerabilities are provided: rce.py: Provides a reverse shell or adds an arbitrary administrator from unprivileged access to th...

CVE-2026-23706

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-23705

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through...

CVE-2026-23707

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-106171

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets...

CVE-2026-23705

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through...

CVE-2026-23705

A SQL Injection vulnerability (CWE-89 ) exists in Fortinet FortiAnalyzer (versions 7.6.0–7.6.4, 7.4.0–7.4.7, and all 7.2 versions) and FortiManager (versions 7.6.0–7.6.4, 7.4.0–7.4.6, and all 7.2 versions). This flaw arises from improper neutralization of special elements in SQL commands, which m...

CVE-2026-23707

A SQL Injection vulnerability (CWE-89 ) exists in several versions of Fortinet FortiAnalyzer and FortiManager products, including FortiAnalyzer (7.6.0-7.6.4, 7.4.0-7.4.7, 7.2 all versions), FortiAnalyzer Cloud, and FortiManager (7.6.0-7.6.4, 7.4.0-7.4.6, 7.2 all versions), as well as FortiManager...

CVE-2026-23706

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-23706

Fortinet FortiAnalyzer and FortiManager products are affected by an SQL Injection vulnerability [CWE-89] caused by improper neutralization of special elements in SQL commands. The flaw impacts FortiAnalyzer versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, all 7.2 versions, and various FortiAnal...

CVE-2026-23707

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-106171

Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.6, and FortiManager Cloud versions 7.6.2 through 7.6.6 are affected by an os command injection vulnerability. This flaw stems from the improper neutralization of special elements used in an os command, which may allow an attacker to achieve ...

CVE-2026-106171

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets...

CVE-2026-23706: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-23705: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through...

CVE-2026-23707: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...