CVE-2024-21762

CVE-2024-21762 Vulnerabilidade de escrita fora dos limites em Fortinet FortiOS CVE-2024-21762 Exploit PoC por assetnote ssldohandshakeptr = b"%60%ce%42%00%00%00%00%00" getcwdptr = b"%70%62%2c%04%00%00%00%00" pivot1 = b"%52%f7%fd%00%00%00%00%00" push rdi; pop rsp; ret; pivot2 =...

CVE-2026-39808

CVE-2026-39808 Fortinet FortiSandbox 4.4.0-4.4.8 - tracer-behavior एंडपॉइंट के माध्यम से OS कमांड इंजेक्शन Fortinet FortiSandbox एक उन्नत खतरा सुरक्षा समाधान है जो संदिग्ध फ़ाइलों, URLs और नेटवर्क ट्रैफ़िक के दुर्भावनापूर्ण व्यवहार का विश्लेषण करने के लिए पृथक वातावरण बनाता है। यह स्टैटिक एनालिसि...

CVE-2018-13382

CVE-2018-13382 CVE-2018-13382 https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/ Fortinet FortiOS 6.0.0 से 6.0.4, 5.6.0 से 5.6.8 और 5.4.1 से 5.4.10 में SSL VPN वेब पोर्टल के अंतर्गत एक अनुचित प्राधिकरण कमजोरी Improper Authorization vulnerability एक अप्रमाणित...

Fortinet FortiWLM Unauthenticated Command Injection Vulnerability

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands Successful exploitation of this vulnerability could allow an attacker to...

Fortinet FortiWeb - Authentication Bypass to Admin Privilege

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges o...

Fortinet FortiMail 7.0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in FortiMail may allow an unauthenticated attacker to perform an attack via specially crafted HTTP GET requests to the FortiGuard URI protection service. id: CVE-2021-43062 info: name: Fortinet FortiMail 7.0.1 - Cross-Site Scripting author: ajaysenr severity:...

Fortinet FortiOS - Cross-Site Scripting

Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters. id: CVE-2018-13380 info: name:...

FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

FortiOS - Insecure LDAP Configuration Detection

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions. id: CVE-2019-5591 info: name: FortiOS -...

Fortinet FortiSandbox - Command Injection

Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input. id: CVE-2026-39808 info: name: Fortinet FortiSandbox - Command...

Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN. id: CVE-2017-3133 info: name: Fortinet FortiOS 5.6.0 - Cross-Site Scripting author: ritikchaddha severity:...

FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting

FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

Fortinet FortiOS - Open Redirect/Cross-Site Scripting

FortiOS Web User Interface in 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting attacks via the "redirect" parameter to "login." id: CVE-2016-3978 info: name: Fortin...

Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken. id: CVE-2017-3132 info: name: Fortinet FortiOS 5.6.0 - Cross-Site Scripting author: ritikchaddh...

FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView. id: CVE-2017-3131 info: name: FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting author:...

Fortinet FortiOS <=5.2.3 - Cross-Site Scripting

Fortinet FortiOS 5.2.x before 5.2.3 contains a cross-site scripting vulnerability in the SSL VPN login page which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. id: CVE-2015-1880 info: name: Fortinet FortiOS =5.2.3 - Cross-Site Scripting author: pikpikcu...

CVE-2022-40684

CVE-2022-40684 Fortinet FortiOS, FortiProxy, और FortiSwitchManager उपकरणों को प्रभावित करने वाले CVE-2022-40684 के लिए POC। तकनीकी विश्लेषण भेद्यता का तकनीकी मूल कारण विश्लेषण हमारे ब्लॉग पर पाया जा सकता है:...

CVE-2022-40684

CVE-2022-40684 POC para CVE-2022-40684 afetando dispositivos Fortinet FortiOS, FortiProxy e FortiSwitchManager. Análise Técnica Uma análise técnica da causa raiz da vulnerabilidade pode ser encontrada em nosso blog:...

Fortijump-Exploit-CVE-2024-47575

CVE-2024-47575 Fortinet FortiManager के बिना प्रमाणीकरण के रिमोट कोड निष्पादन, जिसे FortiJump CVE-2024-47575 भी कहा जाता है तकनीकी विवरण के लिए हमारा ब्लॉग पोस्ट देखें आरंभ करने के लिए, अपना ncat सत्र स्थापित करें: nc -lvvnp 80 फिर, हमारा डिटेक्शन आर्टिफैक्ट जनरेटर चलाएँ: python3 CVE-2024-47575.p...

CVE-2026-21643

🚨 CVE-2026-21643 "FortiGhost" : FortiClientEMS में Pre-Auth SQLi RCE FortiClientEMS 7.4.4 में बिना प्रमाणीकरण के SQL Injection एडमिन GUI पर भेजे गए विशेष रूप से तैयार HTTP अनुरोधों के माध्यम से संभावित Remote Code Execution 📋 अवलोकन CVE-2026-21643 केवल Fortinet FortiClient Endpoint Management...