FO
Product
FortiWeb
On CISA KEVExploited in the wild
126
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 16High 49Medium 51Low 2
Watch
Add FortiWeb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24858 In wildKEV | 9.8 | Jan 27 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Affected: 8.0.0 through 8.0.3; 7.6.0 through 7.6.6; 7.4.0 through 7.4.11 |
| CVE-2025-64446 In wildKEV | 9.8 | Nov 14 | Fortinet FortiWeb Path Traversal Vulnerability Affected: 8.0.0 through 8.0.1; 7.6.0 through 7.6.4; 7.4.0 through 7.4.9; 7.2.0 through 7.2.11; 7.0.0 through 7.0.11 |
| CVE-2025-25257 In wildKEV | 9.8 | Jul 17 | Fortinet FortiWeb SQL Injection Vulnerability Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.7; 7.2.0 through 7.2.10; 7.0.0 through 7.0.10 |
| CVE-2026-26035 | 9.8 | Aug 12 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb… Affected: 8.0.0 through 8.0.2; 7.6.0 through 7.6.6; 7.4.0 through 7.4.11; 7.2.0 through 7.2.12; 7.0.0 through 7.0.12 |
| CVE-2025-59719 | 9.8 | Dec 9 | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an… Affected: 8.0.0; 7.6.0 through 7.6.4; 7.4.0 through 7.4.9 |
| CVE-2023-25610 | 9.8 | Mar 24 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0… Affected: 7.2.0 through 7.2.1; 7.0.0 through 7.0.6; 6.4.0 through 6.4.2; 6.3.0 through 6.3.22; 6.2.0 through 6.2.7; 6.1.0 through 6.1.3 |
| CVE-2024-55594 | 9.8 | Mar 14 | An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows… Affected: 7.4.0 through 7.4.6; 7.2.0 through 7.2.10; 7.0.0 through 7.0.10 |
| CVE-2023-42784 | 9.8 | Mar 11 | An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker… Affected: 7.4.0 through 7.4.7; 7.2.0 through 7.2.10; 7.0.0 through 7.0.10 |
| CVE-2021-42761 | 9.8 | Feb 16 | A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through… Affected: 5.6.0 before 5.9.2; 6.0.0 before 6.0.8; 6.1.0 before 6.1.3; 6.2.0 before 6.2.7; 6.3.0 before 6.3.17; 6.4.0 before 7.0.0 |
| CVE-2021-42756 | 9.8 | Feb 16 | Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and… Affected: 5.6.0 before 6.0.8; 6.1.0 before 6.1.3; 6.2.0 before 6.2.7; 6.3.0 before 6.3.17; 6.4.0 through 6.4.2 |
| CVE-2021-41025 | 9.8 | Dec 8 | Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh… Affected: 6.0.0 through 6.0.7; 6.2.0 through 6.2.6; 6.3.0 through 6.3.15; 6.1.0; 6.1.1; 6.1.2; +3 more |
| CVE-2021-36186 | 9.8 | Nov 2 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted… Affected: 6.2.0 through 6.2.5; 6.3.0 through 6.3.15; 6.4.0 |
| CVE-2020-29016 | 9.8 | Jan 14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the… Affected: before 6.2.4; 6.3.0 through 6.3.5 |
| CVE-2020-29015 | 9.8 | Jan 14 | A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries… Affected: before 6.2.4; 6.3.0 through 6.3.7 |
| CVE-2024-48885 | 9.1 | Jan 16 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4,… Affected: 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.12; 7.0.0 through 7.0.12; 6.4.0 through 6.4.3 |
| CVE-2024-48884 | 9.1 | Jan 14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3,… Affected: 6.4.0 before 7.4.5; 7.6.0 |
Showing 16