CVE-2025-61713: Cleartext Storage of Sensitive Information in Memory

A Cleartext Storage of Sensitive Information in Memory vulnerability CWE-316 in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an authenticated...

Fortinet FortiClientWindows 安全漏洞

Fortinet FortiClientWindows is a Windows-based mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exis...

Fortinet FortiWeb OS Command Injection Vulnerability

Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands...

Fortinet FortiVoice SQL注入漏洞

Fortinet FortiVoice is a Unified Communications and Collaboration-as-a-Service from Fortinet, Inc. A SQL injection vulnerability exists in Fortinet FortiVoice versions 7.2.0 through 7.2.2 and 7.0.0 through 7.0.7, which stems from improperly neutralized SQL commands and could lead to the execution...

⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More

This week showed just how fast things can go wrong when no one's watching. Some attacks were silent and sneaky. Others used tools we trust every day — like AI, VPNs, or app stores — to cause damage without setting off alarms. It's not just about hacking anymore. Criminals are building systems to...

Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild

A critical authentication bypass vulnerability affecting Fortinet FortiWeb web application firewalls has been actively exploited since early October 2025. The vulnerability allows unauthenticated attackers to create admin accounts and gain complete control over vulnerable devices exposed to the...

CVE-2025-64446

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTT...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-64446link is external Fortinet FortiWeb Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and...

Now-Patched Fortinet FortiWeb Flaw Exploited in Attacks to Create Admin Accounts

Cybersecurity researchers are sounding the alert about an authentication bypass vulnerability in Fortinet FortiWeb Web Application Firewall WAF that could allow an attacker to take over admin accounts and completely compromise a device. "The watchTowr team is seeing active, indiscriminate...

Fortinet FortiWeb Authentication Bypass

Fortinet FortiWeb versions 7.0.x 7.0.12, 7.2.x 7.2.12, 7.4.x 7.4.10, 7.6.x 7.6.5, 8.0.x 8.0.2 suffer from an authentication bypass vulnerability. By crafting a specific request, a remote and unauthenticated attacker can create a new user account and compromise the affected system. No source data...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A security vulnerability in Fortinet FortiWe...

CVE-2025-64446: Relative Path Traversal

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTT...

Fortinet FortiWeb create new local admin

This auxiliary module exploits an authentication bypass via path traversal vulnerability in the Fortinet FortiWeb management interface to create a new local administrator user account. This vulnerability affects the following versions: FortiWeb 8.0.0 through 8.0.1 Patched in 8.0.2 and above...

Fortinet FortiWeb Path Traversal Vulnerability

Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests...

Fortinet FortiWeb unauthenticated RCE

This exploit module exploits an authentication bypass via path traversal vulnerability in the Fortinet FortiWeb management interface to create a new local administrator user account. From there a command injection vulnerability is leveraged to achieve RCE with root privileges. The auth bypass...

PT-2025-45058

Name of the Vulnerable Software and Affected Versions Fortinet Secure Access versions prior to 14.12 Description This is a denial of service issue discovered internally. An attacker can send a specially crafted packet to a server configured in a non-default manner, leading to a server crash...

Exploit for Insufficient Session Expiration in Fortinet Fortios

CVE-202...

Fortinet FortiDLP Log Information Disclosure Vulnerability

Fortinet FortiDLP is a data leakage prevention software from the American company Fita Fortinet. Fortinet FortiDLP suffers from a log information disclosure vulnerability that originates from the insertion of sensitive information into a log file, which can be exploited by an attacker to cause...

Fortinet FortiDLP Path Traversal Vulnerability

Fortinet FortiDLP is a data leakage prevention software from the American company Fita Fortinet. Fortinet FortiDLP suffers from a path traversal vulnerability, which stems from the program failing to properly filter special elements in the path of a resource or file, and can be exploited by an...

The vulnerability of Fortinet FortiOS operating systems, related to errors in representing specified functions, allows attackers to execute arbitrary commands.

The vulnerability of Fortinet FortiOS operating systems is related to errors in representing specified functions. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...