FO
Product
FortiWeb
On CISA KEVExploited in the wild
126
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 16High 49Medium 51Low 2
Watch
Add FortiWeb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-41014 | 7.5 | Dec 8 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via… Affected: 6.0.0 through 6.0.7; 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 6.1.0; 6.1.1; 6.1.2; +2 more |
| CVE-2021-36187 | 7.5 | Nov 2 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon… Affected: 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 6.4.0 |
| CVE-2026-40688 | 7.2 | Apr 14 | An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a… Affected: 8.0.0 through 8.0.3; 7.6.0 through 7.6.6; 7.4.0 through 7.4.11 |
| CVE-2025-66178 | 7.2 | Mar 10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6,… Affected: 8.0.0 through 8.0.2; 7.6.0 through 7.6.6; 7.4.0 through 7.4.11; 7.2.0 through 7.2.12; 7.0.0 through 7.0.12 |
| CVE-2025-22254 | 7.2 | Jun 10 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS… Affected: 7.4.0 before 7.4.7; 7.6.0 before 7.6.2 |
| CVE-2025-25254 | 7.2 | Apr 8 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all… Affected: 7.0.0 before 7.4.7; 7.6.0 before 7.6.3 |
| CVE-2024-46671 | 7.2 | Apr 8 | An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets… Affected: 7.0.0 before 7.2.11; 7.4.0 before 7.4.7; 7.6.0 before 7.6.3 |
| CVE-2022-29059 | 7.2 | Mar 14 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and… Affected: 6.2.3 through 6.2.7; 6.3.0 through 6.3.18; 6.4.0 through 6.4.2; 7.0.0 before 7.0.2 |
| CVE-2024-55597 | 7.2 | Mar 11 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or… Affected: 7.0.0 before 7.4.6; 7.6.0 |
| CVE-2024-45324 | 7.2 | Mar 11 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before… Affected: 7.0.0 before 7.0.11; 7.2.0 before 7.2.11; 7.4.0 before 7.4.6; 7.6.0 |
| CVE-2024-50569 | 7.2 | Feb 11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code… Affected: 7.0.0 before 7.4.6; 7.6.0 |
| CVE-2024-50567 | 7.2 | Feb 11 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execute unauthorized code… Affected: 7.0.0 before 7.4.6; 7.6.0 |
| CVE-2023-23777 | 7.2 | Jul 11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version… Affected: 6.3.6 through 6.3.18; 6.4.0 through 6.4.3; 7.0.0; 7.0.1 |
| CVE-2022-33871 | 7.2 | Feb 16 | A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to… Affected: 6.3.6 before 6.3.20; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1 |
| CVE-2021-36193 | 7.2 | Feb 2 | Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via… Affected: 5.0.0 before 6.2.6; 6.3.0 before 6.3.16; 6.4.0 before 6.4.2 |
| CVE-2026-39814 | 6.7 | Apr 14 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 through 7.2.12,… Affected: 8.0.0 through 8.0.2; 7.6.0 through 7.6.6; 7.4.1 through 7.4.12 |
| CVE-2025-47857 | 6.7 | Aug 12 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before… Affected: 7.4.1 before 7.4.9; 7.6.0 before 7.6.4 |
| CVE-2025-32766 | 6.7 | Aug 12 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code… Affected: 7.4.1 before 7.4.9; 7.6.0 before 7.6.4 |
| CVE-2025-27759 | 6.7 | Aug 12 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0… Affected: 7.0.0 before 7.0.11; 7.2.0 before 7.2.11; 7.4.0 before 7.4.8; 7.6.0 before 7.6.4 |
| CVE-2024-21758 | 6.7 | Jan 14 | A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially… Affected: 7.2.0 before 7.2.8; 7.4.0 before 7.4.2 |
| CVE-2021-42757 | 6.7 | Dec 8 | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code… Affected: 5.0.0 through 6.3.16; 6.4.0; 6.4.1 |
| CVE-2026-30897 | 6.6 | Mar 10 | A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2 all versions,… Affected: 7.0.0 before 7.4.12; 7.6.0 before 7.6.7; 8.0.0 before 8.0.4 |
| CVE-2026-24640 | 6.6 | Mar 10 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2… Affected: 7.0.2 through 7.0.12; 7.2.0 before 7.6.7; 8.0.0 before 8.0.3 |
| CVE-2026-24641 | 6.5 | Mar 10 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2… Affected: 7.0.0 before 7.6.7; 8.0.0 before 8.0.3 |
| CVE-2023-33305 | 6.5 | Jun 13 | A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS… Affected: 6.3.0 through 6.3.23; 6.4.0 through 6.4.3; 7.0.0 through 7.0.6; 7.2.0; 7.2.1 |
| CVE-2023-23784 | 6.5 | Feb 16 | A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information… Affected: 6.3.6 before 6.3.21; 6.4.0 through 6.4.2; 7.0.0 before 7.0.3 |
| CVE-2023-23778 | 6.5 | Feb 16 | A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to… Affected: 6.2.3 through 6.2.7; 6.3.0 through 6.3.21; 6.4.0; 6.4.1; 6.4.2; 7.0.0; +1 more |
| CVE-2022-30300 | 6.5 | Feb 16 | A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized… Affected: 6.3.6 before 6.3.19; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1 |
| CVE-2021-41026 | 6.5 | Apr 6 | A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying… Affected: 6.3.0 before 6.3.16; 6.4.0 before 6.4.2 |
| CVE-2020-15942 | 6.5 | Apr 12 | An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote… Affected: 6.2.0 through 6.2.3; 6.3.0 through 6.3.4 |
| CVE-2019-16157 | 6.5 | Mar 13 | An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via diagnose debug… Affected: through 6.2.0 |
| CVE-2021-36190 | 6.3 | Dec 8 | A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts… Affected: 6.0.0 through 6.0.7; 6.2.0 through 6.2.6; 6.3.0 through 6.3.15; 6.1.0; 6.1.1; 6.1.2; +2 more |
| CVE-2022-43955 | 6.1 | Apr 11 | An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all… Affected: 6.0.0 through 6.2.7; 6.3.0 before 6.3.22; 6.4.0 through 6.4.2; 7.0.0 before 7.0.4 |
| CVE-2021-36188 | 6.1 | Dec 8 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute… Affected: 6.0.0 through 6.2.5; 6.3.0 before 6.3.16; 6.4.0 before 6.4.2 |
| CVE-2021-43063 | 6.1 | Dec 8 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and… Affected: 6.2.0 through 6.2.6; 6.3.0 through 6.3.15; 6.4.0; 6.4.1 |
| CVE-2021-43064 | 6.1 | Dec 8 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the… Affected: 6.2.0 through 6.2.6; 6.3.0 through 6.3.15; 6.4.0; 6.4.1 |
| CVE-2021-41015 | 6.1 | Dec 8 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute… Affected: 6.4.0; 6.4.1 |
| CVE-2021-22122 | 6.1 | Feb 8 | An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker… Affected: through 6.2.3; 6.3.0 through 6.3.7 |
| CVE-2019-16156 | 6.1 | Mar 12 | An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker… Affected: 6.0.0 through 6.0.5; 6.1.0 through 6.1.1; 6.2.0 |
| CVE-2019-5590 | 6.1 | Aug 28 | The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting)… Affected: through 6.0.2 |
| CVE-2012-6346 | 6.1 | Feb 9 | Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) redir or (2) mkey parameter… Affected: before 4.4.4 |
| CVE-2017-3129 | 6.1 | May 27 | A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST… Affected: through 5.7.1 |
| CVE-2017-14191 | 5.9 | Mar 20 | An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie… Affected: 5.6.0 before 6.1.0 |
| CVE-2025-59669 | 5.5 | Nov 18 | A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an… Affected: 7.0.0 before 7.6.1 |
| CVE-2024-23107 | 5.5 | Jun 3 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions… Affected: 6.3.0 through 6.3.23; 7.0.0 before 7.0.9; 7.2.0 before 7.2.5; 7.4.0 |
| CVE-2022-22297 | 5.5 | Mar 7 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb… Affected: 6.0.0 through 6.0.8; 6.1.0 through 6.1.3; 6.2.0 through 6.2.7; 6.3.0 through 6.3.17; 6.4.0 through 6.4.3 |
| CVE-2022-42471 | 5.4 | Jan 3 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0… Affected: 6.3.6 through 6.3.21; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1; +1 more |
| CVE-2021-36191 | 5.4 | Dec 8 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET… Affected: 6.0.0 through 6.0.7; 6.2.0 through 6.2.6; 6.3.0 through 6.3.15; 6.1.0; 6.1.1; 6.1.2; +2 more |
| CVE-2021-36175 | 5.4 | Oct 6 | An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject… Affected: 6.0.0 before 6.2.4 |
| CVE-2020-6646 | 5.4 | Mar 17 | An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer… Affected: through 6.2.2; 6.3.0 |