CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2025-24470
https://notcve.org/view.php?id=CVE-2025-24470
11 Feb 2025 — An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to retrieve source code via crafted HTTP requests. An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to retrieve source code via crafted HTTP requests. • https://fortiguard.fortinet.com/psirt/FG-IR-25-015 • CWE-41: Improper Resolution of Path Equivalence •
CVSS: 4.7EPSS: 0%CPEs: 99EXPL: 0CVE-2022-23439
https://notcve.org/view.php?id=CVE-2022-23439
22 Jan 2025 — A externally controlled reference to a resource in another sphere in Fortinet FortiManager before version 7.4.3, FortiMail before version 7.0.3, FortiAnalyzer before version 7.4.3, FortiVoice version 7.0.0, 7.0.1 and before 6.4.8, FortiProxy before version 7.0.4, FortiRecorder version 6.4.0 through 6.4.2 and before 6.0.10, FortiAuthenticator version 6.4.0 through 6.4.1 and before 6.3.3, FortiNDR version 7.2.0 before 7.1.0, FortiWLC before version 8.6.4, FortiPortal before version 6.0.9, FortiOS version 7.2.... • https://fortiguard.com/psirt/FG-IR-21-254 • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-35278
https://notcve.org/view.php?id=CVE-2024-35278
14 Jan 2025 — A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request. • https://fortiguard.fortinet.com/psirt/FG-IR-24-086 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21759
https://notcve.org/view.php?id=CVE-2024-21759
09 Jul 2024 — An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorized resources via HTTP or HTTPS requests. • https://fortiguard.fortinet.com/psirt/FG-IR-24-011 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-31495
https://notcve.org/view.php?id=CVE-2024-31495
11 Jun 2024 — A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality. Una neutralización inadecuada de elementos especiales utilizados en un comando sql ("inyección sql") en las versiones 7.0.0 a 7.0.6 y 7.2.0 de Fortinet FortiPortal permite a un usuario privilegiado obtener información no autorizada a través de la funcionali... • https://fortiguard.fortinet.com/psirt/FG-IR-24-128 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23105
https://notcve.org/view.php?id=CVE-2024-23105
14 May 2024 — A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets. Una vulnerabilidad de uso de fuente menos confiable [CWE-348] en Fortinet FortiPortal versión 7.0.0 a 7.0.6 y versión 7.2.0 a 7.2.1 permite que un ataque no autenticado evite la protección IP a través de paquetes HTTP o HTTPS manipulados. • https://fortiguard.com/psirt/FG-IR-24-021 • CWE-348: Use of Less Trusted Source •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21761
https://notcve.org/view.php?id=CVE-2024-21761
12 Mar 2024 — An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload. Una vulnerabilidad de autorización inadecuada [CWE-285] en los informes de FortiPortal versión 7.2.0 y versiones 7.0.6 e inferiores puede permitir a un usuario descargar informes de otras organizaciones mediante modificaciones en el payload de la solicitud. • https://fortiguard.com/psirt/FG-IR-24-016 • CWE-285: Improper Authorization •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-48783
https://notcve.org/view.php?id=CVE-2023-48783
10 Jan 2024 — An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests. Una vulnerabilidad de omisión de autorización a través de clave controlada por el usuario [CWE-639] que afecta a PortiPortal versión 7.2.1 e inferior, versión 7.0.6 e infer... • https://fortiguard.com/psirt/FG-IR-23-408 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-46712
https://notcve.org/view.php?id=CVE-2023-46712
10 Jan 2024 — A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests. Un control de acceso inadecuado en Fortinet FortiPortal versión 7.0.0 a 7.0.6, Fortinet FortiPortal versión 7.2.0 a 7.2.1 permite al atacante escalar su privilegio a través de solicitudes HTTP específicamente manipuladas. • https://fortiguard.com/psirt/FG-IR-23-395 • CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48791
https://notcve.org/view.php?id=CVE-2023-48791
13 Dec 2023 — An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted arguments in the Schedule System Backup page field. Una neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando ('Inyección de comando') [CWE-77] en FortiPortal versión 7.2.0, versi... • https://fortiguard.com/psirt/FG-IR-23-425 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •