# Fortinet FortiPortal. Every CVE that names Fortinet FortiPortal among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Improper access control in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2026-49938.md) `CVE-2026-49938` · CVE record: Fortinet FortiPortal · CVSS 6.2 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Broken access control - [Fortinet FortiAnalyzer: A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2…](https://agentprime.io/advisories/CVE-2024-40593.md) `CVE-2024-40593` · CVE record: Fortinet FortiAnalyzer and 3 more · CVSS 5.9 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-320 - [Incorrect authorization in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2025-54838.md) `CVE-2025-54838` · CVE record: Fortinet FortiPortal · CVSS 6.4 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Broken access control - [Insecure direct object reference in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-45329.md) `CVE-2024-45329` · CVE record: Fortinet FortiPortal · CVSS 3.9 Low · Not analysed yet · Published 10 Jun 2025 · Tags: Broken access control - [Sensitive information in log files in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2025-46777.md) `CVE-2025-46777` · CVE record: Fortinet FortiPortal · CVSS 2.2 Low · Not analysed yet · Published 28 May 2025 · Tags: Information disclosure - [Improper certificate validation in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-40590.md) `CVE-2024-40590` · CVE record: Fortinet FortiPortal · CVSS 4.4 Medium · Not analysed yet · Published 14 Mar 2025 · Tags: Weak cryptography or TLS - [Fortinet FortiPortal: An Improper Resolution of Path Equivalence vulnerability \[CWE-41\] in FortiPortal 7.4.0…](https://agentprime.io/advisories/CVE-2025-24470.md) `CVE-2025-24470` · CVE record: Fortinet FortiPortal · CVSS 8.1 High · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-41 - [A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the \`Host\` header points to an arbitr…](https://agentprime.io/advisories/CVE-2022-23439.md) `CVE-2022-23439` · CVE record: Fortinet FortiTester and 4 more · CVSS 4.1 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: CWE-610 - [SQL injection in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-35278.md) `CVE-2024-35278` · CVE record: Fortinet FortiPortal · CVSS 4.1 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: SQL injection - [Cross-site scripting in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-52967.md) `CVE-2024-52967` · CVE record: Fortinet FortiPortal · CVSS 3.3 Low · Not analysed yet · Published 14 Jan 2025 · Tags: Cross-site scripting (XSS) - [Missing authentication in Fortinet FortiManager and others](https://agentprime.io/advisories/CVE-2024-26011.md) `CVE-2024-26011` · CVE record: Fortinet FortiManager and 4 more · CVSS 5.2 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Authentication bypass - [Insecure direct object reference in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2023-47543.md) `CVE-2023-47543` · CVE record: Fortinet FortiPortal · CVSS 5.1 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Broken access control - [Insecure direct object reference in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-21759.md) `CVE-2024-21759` · CVE record: Fortinet FortiPortal · CVSS 3.9 Low · Not analysed yet · Published 9 Jul 2024 · Tags: Broken access control - [SQL injection in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-31495.md) `CVE-2024-31495` · CVE record: Fortinet FortiPortal · CVSS 3.9 Low · Not analysed yet · Published 11 Jun 2024 · Tags: SQL injection - [Fortinet FortiPortal: A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0…](https://agentprime.io/advisories/CVE-2023-48789.md) `CVE-2023-48789` · CVE record: Fortinet FortiPortal · CVSS 4.1 Medium · Not analysed yet · Published 3 Jun 2024 · Tags: CWE-602 - [Fortinet FortiPortal: A Use Of Less Trusted Source \[CWE-348\] vulnerability in Fortinet FortiPortal version…](https://agentprime.io/advisories/CVE-2024-23105.md) `CVE-2024-23105` · CVE record: Fortinet FortiPortal · CVSS 7.1 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-348 - [Improper authorization in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2024-21761.md) `CVE-2024-21761` · CVE record: Fortinet FortiPortal · CVSS 3.9 Low · Not analysed yet · Published 12 Mar 2024 · Tags: Broken access control - [Uncontrolled format string in Fortinet FortiPortal and others](https://agentprime.io/advisories/CVE-2023-41842.md) `CVE-2023-41842` · CVE record: Fortinet FortiPortal and 3 more · CVSS 6.3 Medium · Not analysed yet · Published 12 Mar 2024 · Tags: Memory corruption - [Insecure direct object reference in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2023-48783.md) `CVE-2023-48783` · CVE record: Fortinet FortiPortal · CVSS 4.9 Medium · EPSS 0.22 · Not analysed yet · Published 10 Jan 2024 · Tags: Broken access control - [Improper access control in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2023-46712.md) `CVE-2023-46712` · CVE record: Fortinet FortiPortal · CVSS 6.3 Medium · Not analysed yet · Published 10 Jan 2024 · Tags: Broken access control - [Command injection in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2023-48791.md) `CVE-2023-48791` · CVE record: Fortinet FortiPortal · CVSS 7.9 High · Not analysed yet · Published 13 Dec 2023 · Tags: Command injection - [Information disclosure in Fortinet FortiManager and others](https://agentprime.io/advisories/CVE-2022-27490.md) `CVE-2022-27490` · CVE record: Fortinet FortiManager and 3 more · CVSS 5.1 Medium · Not analysed yet · Published 7 Mar 2023 · Tags: Information disclosure - [Sensitive information in log files in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2022-43954.md) `CVE-2022-43954` · CVE record: Fortinet FortiPortal · CVSS 4.1 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Information disclosure - [Cross-site scripting in Fortinet FortiPortal](https://agentprime.io/advisories/CVE-2022-41336.md) `CVE-2022-41336` · CVE record: Fortinet FortiPortal · CVSS 6.6 Medium · Not analysed yet · Published 3 Jan 2023 · Tags: Cross-site scripting (XSS) - [The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the who…](https://agentprime.io/advisories/CVE-2021-36171.md) `CVE-2021-36171` · CVE record: Fortinet Fortinet FortiPortal · CVSS 8.1 High · Not analysed yet · Published 1 Mar 2022 - [Buffer overflow in Fortinet FortiOS and others](https://agentprime.io/advisories/CVE-2021-42757.md) `CVE-2021-42757` · CVE record: Fortinet FortiOS and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 8 Dec 2021 · Tags: Memory corruption - [A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service attack via specially…](https://agentprime.io/advisories/CVE-2021-36174.md) `CVE-2021-36174` · CVE record: Fortinet Fortinet FortiPortal · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2021 - [Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requ…](https://agentprime.io/advisories/CVE-2021-36176.md) `CVE-2021-36176` · CVE record: Fortinet Fortinet FortiPortal · CVSS 6.1 Medium · Not analysed yet · Published 2 Nov 2021 - [Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requ…](https://agentprime.io/advisories/CVE-2021-32595.md) `CVE-2021-32595` · CVE record: Fortinet Fortinet FortiPortal · CVSS 6.5 Medium · Not analysed yet · Published 2 Nov 2021 - [An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consum…](https://agentprime.io/advisories/CVE-2021-36172.md) `CVE-2021-36172` · CVE record: Fortinet Fortinet FortiPortal · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2021 - [A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated,…](https://agentprime.io/advisories/CVE-2021-36181.md) `CVE-2021-36181` · CVE record: Fortinet Fortinet FortiPortal · CVSS 3.1 Low · Not analysed yet · Published 2 Nov 2021 - [An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and…](https://agentprime.io/advisories/CVE-2021-32602.md) `CVE-2021-32602` · CVE record: Fortinet Fortinet FortiPortal · CVSS 5.8 Medium · Not analysed yet · Published 18 Aug 2021 - [A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated atta…](https://agentprime.io/advisories/CVE-2021-32588.md) `CVE-2021-32588` · CVE record: Fortinet Fortinet FortiPortal · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2021 - [A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to de…](https://agentprime.io/advisories/CVE-2021-32596.md) `CVE-2021-32596` · CVE record: Fortinet Fortinet FortiPortal · CVSS 6.0 Medium · Not analysed yet · Published 4 Aug 2021 - [Fortinet FortiPortal: A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in…](https://agentprime.io/advisories/CVE-2021-36168.md) `CVE-2021-36168` · CVE record: Fortinet Fortinet FortiPortal · CVSS 6.5 Medium · Not analysed yet · Published 4 Aug 2021 - [Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may all…](https://agentprime.io/advisories/CVE-2021-32590.md) `CVE-2021-32590` · CVE record: Fortinet Fortinet FortiPortal · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2021 - [An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to p…](https://agentprime.io/advisories/CVE-2021-32594.md) `CVE-2021-32594` · CVE record: Fortinet Fortinet FortiPortal · CVSS 5.4 Medium · Not analysed yet · Published 4 Aug 2021 - [Fortinet FortiPortal: A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below…](https://agentprime.io/advisories/CVE-2017-7340.md) `CVE-2017-7340` · CVE record: Fortinet Fortinet FortiPortal · No CVSS score · Not analysed yet · Published 25 Mar 2019 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .