FO
Product
FortiWeb
On CISA KEVExploited in the wild
126
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 16High 49Medium 51Low 2
Watch
Add FortiWeb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-58034 In wildKEV | 7.2 | Nov 18 | Fortinet FortiWeb OS Command Injection Vulnerability Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.8; 7.2.0 through 7.2.11; 7.0.2 through 7.0.11 |
| CVE-2024-23665 | 8.8 | Jun 3 | Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version… Affected: 6.3.0 through 6.3.23; 6.4.0 through 6.4.3; 7.0.0 through 7.0.10; 7.2.0 before 7.2.8; 7.4.0 before 7.4.3 |
| CVE-2023-34984 | 8.8 | Sep 13 | A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized… Affected: 6.3.6 through 6.3.23; 6.4.0 through 6.4.3; 7.0.0 through 7.0.6; 7.2.0 through 7.2.1 |
| CVE-2022-39951 | 8.8 | Mar 7 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through… Affected: 6.3.6 through 6.3.20; 6.4.0 through 6.4.2; 7.0.0 through 7.0.2 |
| CVE-2023-23781 | 8.8 | Feb 16 | A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML server configuration may allow an… Affected: 6.3.0 before 6.3.20; 6.4.0 through 6.4.2; 7.0.0 before 7.0.2 |
| CVE-2023-23780 | 8.8 | Feb 16 | A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker… Affected: 6.3.0 before 6.3.20; 6.4.0 through 6.4.2; 7.0.0 before 7.0.2 |
| CVE-2023-23779 | 8.8 | Feb 16 | Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions,… Affected: 6.3.6 through 6.3.19; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1 |
| CVE-2022-30306 | 8.8 | Feb 16 | A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an… Affected: 6.3.6 before 6.3.20; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1 |
| CVE-2022-30303 | 8.8 | Feb 16 | An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may… Affected: 6.3.0 before 6.3.20; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1 |
| CVE-2021-41018 | 8.8 | Feb 2 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to… Affected: 6.2.0 before 6.2.7; 6.3.0 before 6.3.16; 6.4.0 before 6.4.2 |
| CVE-2021-43073 | 8.8 | Feb 2 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6… Affected: 5.8.0 before 6.2.7; 6.3.0 before 6.3.17; 6.4.0 before 6.4.2 |
| CVE-2021-43071 | 8.8 | Dec 9 | A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or… Affected: 6.2.0 through 6.2.6; 6.3.0 through 6.3.16; 6.4.0; 6.4.1 |
| CVE-2021-36194 | 8.8 | Dec 9 | Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code… Affected: 6.3.0 through 6.3.15; 6.4.0; 6.4.1 |
| CVE-2021-41017 | 8.8 | Dec 8 | Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to… Affected: 6.3.0 through 6.3.15; 6.4.0; 6.4.1 |
| CVE-2021-36195 | 8.8 | Dec 8 | Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2… Affected: 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 6.1.0; 6.1.1; 6.1.2; 6.4.0; +1 more |
| CVE-2021-36180 | 8.8 | Dec 8 | Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below… Affected: 5.8.0 through 5.8.6; 6.0.0 through 6.0.7; 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 5.9.0; 5.9.1; +4 more |
| CVE-2021-36182 | 8.8 | Sep 8 | A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or… Affected: through 6.2.4; 6.3.0 before 6.3.14 |
| CVE-2021-36179 | 8.8 | Sep 8 | A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI… Affected: through 6.2.4; 6.3.0 through 6.3.14 |
| CVE-2021-22123 | 8.8 | Jun 1 | An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute… Affected: 5.9.0 before 6.2.4; 6.3.0 before 6.3.8 |
| CVE-2020-29018 | 8.8 | Jan 14 | A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir… Affected: 6.3.0 through 6.3.5 |
| CVE-2016-4066 | 8.8 | Jul 13 | Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change… Affected: through 5.5.2 |
| CVE-2026-24017 | 8.1 | Mar 10 | An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through… Affected: 7.0.0 before 7.0.12; 7.2.0 before 7.2.12; 7.4.0 before 7.4.11; 7.6.0 before 7.6.6; 8.0.0 before 8.0.3 |
| CVE-2025-64447 | 8.1 | Dec 9 | A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through… Affected: 7.0.0 through 7.0.11; 7.2.0 through 7.2.11; 7.4.0 through 7.4.10; 7.6.0 through 7.6.5; 8.0.0 through 8.0.1 |
| CVE-2025-52970 | 8.1 | Aug 12 | A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an… Affected: 7.0.0 before 7.0.11; 7.2.0 before 7.2.11; 7.4.0 before 7.4.8; 7.6.0 before 7.6.4 |
| CVE-2021-42753 | 8.1 | Feb 2 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x,… Affected: 5.8.0 before 6.3.16; 6.4.0 before 6.4.2 |
| CVE-2022-43948 | 7.8 | Apr 11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through… Affected: 7.0.0 before 7.0.4 |
| CVE-2023-25602 | 7.8 | Feb 16 | A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and… Affected: 5.6.0 before 5.9.2; 6.0.0 before 6.0.8; 6.1.0 before 6.1.3; 6.2.0 before 6.2.7; 6.3.0 before 6.3.18; 6.4.0 through 6.4.2 |
| CVE-2023-23783 | 7.8 | Feb 16 | A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands… Affected: 6.4.0 before 6.4.2; 7.0.0 before 7.0.2 |
| CVE-2023-23782 | 7.8 | Feb 16 | A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions,… Affected: 6.0.0 through 6.2.7; 6.3.0 before 6.3.20; 6.4.0 through 6.4.2; 7.0.0 before 7.0.2 |
| CVE-2022-40683 | 7.8 | Feb 16 | A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands Affected: 7.0.0 through 7.0.3 |
| CVE-2021-41027 | 7.8 | Dec 8 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates… Affected: 6.4.0; 6.4.1 |
| CVE-2025-64471 | 7.5 | Dec 9 | A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5,… Affected: 7.0.0 through 7.0.11; 7.2.0 through 7.2.11; 7.4.0 through 7.4.10; 7.6.0 through 7.6.4; 8.0.0 through 8.0.1 |
| CVE-2024-50565 | 7.5 | Apr 8 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through… Affected: 7.4.0 before 7.4.3 |
| CVE-2024-26013 | 7.5 | Apr 8 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through… Affected: 7.4.0 before 7.4.3 |
| CVE-2021-41014 | 7.5 | Dec 8 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via… Affected: 6.0.0 through 6.0.7; 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 6.1.0; 6.1.1; 6.1.2; +2 more |
| CVE-2021-36187 | 7.5 | Nov 2 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon… Affected: 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 6.4.0 |
| CVE-2026-40688 | 7.2 | Apr 14 | An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a… Affected: 8.0.0 through 8.0.3; 7.6.0 through 7.6.6; 7.4.0 through 7.4.11 |
| CVE-2025-66178 | 7.2 | Mar 10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6,… Affected: 8.0.0 through 8.0.2; 7.6.0 through 7.6.6; 7.4.0 through 7.4.11; 7.2.0 through 7.2.12; 7.0.0 through 7.0.12 |
| CVE-2025-22254 | 7.2 | Jun 10 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS… Affected: 7.4.0 before 7.4.7; 7.6.0 before 7.6.2 |
| CVE-2025-25254 | 7.2 | Apr 8 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all… Affected: 7.0.0 before 7.4.7; 7.6.0 before 7.6.3 |
| CVE-2024-46671 | 7.2 | Apr 8 | An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets… Affected: 7.0.0 before 7.2.11; 7.4.0 before 7.4.7; 7.6.0 before 7.6.3 |
| CVE-2022-29059 | 7.2 | Mar 14 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and… Affected: 6.2.3 through 6.2.7; 6.3.0 through 6.3.18; 6.4.0 through 6.4.2; 7.0.0 before 7.0.2 |
| CVE-2024-55597 | 7.2 | Mar 11 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or… Affected: 7.0.0 before 7.4.6; 7.6.0 |
| CVE-2024-45324 | 7.2 | Mar 11 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before… Affected: 7.0.0 before 7.0.11; 7.2.0 before 7.2.11; 7.4.0 before 7.4.6; 7.6.0 |
| CVE-2024-50569 | 7.2 | Feb 11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code… Affected: 7.0.0 before 7.4.6; 7.6.0 |
| CVE-2024-50567 | 7.2 | Feb 11 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execute unauthorized code… Affected: 7.0.0 before 7.4.6; 7.6.0 |
| CVE-2023-23777 | 7.2 | Jul 11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version… Affected: 6.3.6 through 6.3.18; 6.4.0 through 6.4.3; 7.0.0; 7.0.1 |
| CVE-2022-33871 | 7.2 | Feb 16 | A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to… Affected: 6.3.6 before 6.3.20; 6.4.0; 6.4.1; 6.4.2; 7.0.0; 7.0.1 |
| CVE-2021-36193 | 7.2 | Feb 2 | Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via… Affected: 5.0.0 before 6.2.6; 6.3.0 before 6.3.16; 6.4.0 before 6.4.2 |
Showing 49