Fortinet Fortiweb
124 CVEs affecting Fortinet Fortiweb. Latest disclosed: 2026-04-14. Critical: 9, High: 37.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24858 | Critical | 9.8 | 2026-01-27 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer… |
CVE-2025-59719 | Critical | 9.8 | 2025-12-09 | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may al… |
CVE-2025-64446 | Critical | 9.8 | 2025-11-14 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 th… |
CVE-2025-25257 | Critical | 9.8 | 2025-07-17 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through… |
CVE-2023-25610 | Critical | 9.8 | 2025-03-24 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7… |
CVE-2021-42756 | Critical | 9.8 | 2023-02-16 | Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and be… |
CVE-2020-29016 | Critical | 9.8 | 2021-01-14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite… |
CVE-2020-29015 | Critical | 9.8 | 2021-01-14 | A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute a… |
CVE-2021-42761 | Critical | 9.0 | 2023-02-16 | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6… |
CVE-2022-43955 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versio… |
CVE-2022-30303 | High | 8.8 | 2023-02-16 | An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6… |
CVE-2021-41018 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below all… |
CVE-2021-43073 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and b… |
CVE-2021-43071 | High | 8.8 | 2021-12-09 | A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unautho… |
CVE-2021-36194 | High | 8.8 | 2021-12-09 | Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve… |
CVE-2021-41017 | High | 8.8 | 2021-12-08 | Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authentic… |
CVE-2021-36186 | High | 8.8 | 2021-11-02 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or com… |
CVE-2021-36182 | High | 8.8 | 2021-09-08 | A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute… |
CVE-2020-29018 | High | 8.8 | 2021-01-14 | A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive… |
CVE-2016-4066 | High | 8.8 | 2016-07-13 | Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for re… |