PT-2025-2439

Name of the Vulnerable Software and Affected Versions: Fortinet FortiPortal versions 7.0.0 through 7.2.8 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'sql injection'. This may allow an authenticated attacker to view the...

Fortinet FortiPortal和Fortinet FortiManager 访问控制错误漏洞

Fortinet FortiManager and Fortinet FortiPortal are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. Fortinet FortiManager is a centralized network security management platform that supports centralized management of any number of Fortine...

PT-2025-1187 · Fortinet · Fortimanager +4

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.0 through 6.4.15 Fortinet FortiOS versions 7.0.0 through 7.0.15 Fortinet FortiOS versions 7.2.0 through 7.2.8 Fortinet FortiOS versions 7.4.0 through 7.4.4 FortiProxy versions 2.0.0 through 2.0.14 FortiProxy...

Path traversal in csfd daemon

...

CVE-2024-52967: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection...

CVE-2024-47571: Operation on a Resource after Expiration or Release

An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials...

CVE-2024-46667: Allocation of Resources Without Limits or Throttling

A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to deny valid TLS traffic via consuming all allotted connections...

CVE-2024-35275: Improper Neutralization of Special Elements used in an SQL Command

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests...

CVE-2024-21758: Stack-based Buffer Overflow

A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially crafted CLI commands, provided the user is able to evade FortiWeb stack protections...

CVE-2023-37936: Use of Hard-coded Cryptographic Key

A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via crafted requests...

CVE-2024-55593: Improper Neutralization of Special Elements used in an SQL Command

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWeb versions 6.3.17 through 7.6.1 allows attacker to gain information disclosure via crafted SQL queries...

CVE-2024-47572: Improper Neutralization of Formula Elements in a CSV File

An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file...

CVE-2024-33502: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12 allows attacker to execu...

CVE-2023-37937: Improper Neutralization of Special Elements used in an OS Command

An improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code o...

Fortinet FortiManager 操作系统命令注入漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...

PT-2025-1191

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 4.4.0 through 4.4.4 Fortinet FortiSandbox versions 4.2.0 through 4.2.6 Fortinet FortiSandbox versions prior to 4.0.4 Description The issue is related to an improper neutralization of special elements used in an O...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in Fortinet...

PT-2025-1437

Name of the Vulnerable Software and Affected Versions Fortinet FortiSwitch versions 6.0.0 through 6.0.7 Fortinet FortiSwitch versions 6.2.0 through 6.2.7 Fortinet FortiSwitch versions 6.4.0 through 6.4.13 Fortinet FortiSwitch versions 7.0.0 through 7.0.7 Fortinet FortiSwitch versions 7.2.0 throug...

PT-2025-2946

Name of the Vulnerable Software and Affected Versions Fortinet FortiPortal versions 6.0.0 through 6.0.14 Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which allows an attacker to execute unauthorized code or commands via HTML injection...

Fortinet FortiSIEM SQL注入漏洞

Fortinet FortiSIEM is a security information and event management system from Fortinet, Inc. The system includes features such as asset discovery, workflow automation, and unified management. Fortinet FortiSIEM suffers from an SQL injection vulnerability that stems from improper neutralization of...