Advisories · Technology

Fortinet FortiPortal.

Every CVE that names Fortinet FortiPortal among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-49938 CVE record

CVSS 6.2 Medium

Improper access control in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 9 Jun 2026
CVE-2024-40593 CVE record

CVSS 5.9 Medium

Fortinet FortiAnalyzer: A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2…
- Fortinet FortiAnalyzer
- Fortinet FortiPortal
- CWE-320
Not analysed yet 11 Dec 2025
CVE-2025-54838 CVE record

CVSS 6.4 Medium

Incorrect authorization in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 9 Dec 2025
CVE-2024-45329 CVE record

CVSS 3.9 Low

Insecure direct object reference in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 10 Jun 2025
CVE-2025-46777 CVE record

CVSS 2.2 Low

Sensitive information in log files in Fortinet FortiPortal
- Fortinet FortiPortal
- Information disclosure
Not analysed yet 28 May 2025
CVE-2024-40590 CVE record

CVSS 4.4 Medium

Improper certificate validation in Fortinet FortiPortal
- Fortinet FortiPortal
- Weak cryptography or TLS
Not analysed yet 14 Mar 2025
CVE-2025-24470 CVE record

CVSS 8.1 High

Fortinet FortiPortal: An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0…
- Fortinet FortiPortal
- CWE-41
Not analysed yet 11 Feb 2025
CVE-2022-23439 CVE record

CVSS 4.1 Medium

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitr…
- Fortinet FortiTester
- Fortinet FortiOS
- CWE-610
Not analysed yet 22 Jan 2025
CVE-2024-35278 CVE record

CVSS 4.1 Medium

SQL injection in Fortinet FortiPortal
- Fortinet FortiPortal
- SQL injection
Not analysed yet 14 Jan 2025
CVE-2024-52967 CVE record

CVSS 3.3 Low

Cross-site scripting in Fortinet FortiPortal
- Fortinet FortiPortal
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2025
CVE-2024-26011 CVE record

CVSS 5.2 Medium

Missing authentication in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiOS
- Authentication bypass
Not analysed yet 12 Nov 2024
CVE-2023-47543 CVE record

CVSS 5.1 Medium

Insecure direct object reference in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 12 Nov 2024
CVE-2024-21759 CVE record

CVSS 3.9 Low

Insecure direct object reference in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 9 Jul 2024
CVE-2024-31495 CVE record

CVSS 3.9 Low

SQL injection in Fortinet FortiPortal
- Fortinet FortiPortal
- SQL injection
Not analysed yet 11 Jun 2024
CVE-2023-48789 CVE record

CVSS 4.1 Medium

Fortinet FortiPortal: A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0…
- Fortinet FortiPortal
- CWE-602
Not analysed yet 3 Jun 2024
CVE-2024-23105 CVE record

CVSS 7.1 High

Fortinet FortiPortal: A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version…
- Fortinet FortiPortal
- CWE-348
Not analysed yet 14 May 2024
CVE-2024-21761 CVE record

CVSS 3.9 Low

Improper authorization in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 12 Mar 2024
CVE-2023-41842 CVE record

CVSS 6.3 Medium

Uncontrolled format string in Fortinet FortiPortal and others
- Fortinet FortiPortal
- Fortinet FortiAnalyzer-BigData
- Memory corruption
Not analysed yet 12 Mar 2024
CVE-2023-48783 CVE record

CVSS 4.9 Medium

Insecure direct object reference in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 10 Jan 2024
CVE-2023-46712 CVE record

CVSS 6.3 Medium

Improper access control in Fortinet FortiPortal
- Fortinet FortiPortal
- Broken access control
Not analysed yet 10 Jan 2024
CVE-2023-48791 CVE record

CVSS 7.9 High

Command injection in Fortinet FortiPortal
- Fortinet FortiPortal
- Command injection
Not analysed yet 13 Dec 2023
CVE-2022-27490 CVE record

CVSS 5.1 Medium

Information disclosure in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- Information disclosure
Not analysed yet 7 Mar 2023
CVE-2022-43954 CVE record

CVSS 4.1 Medium

Sensitive information in log files in Fortinet FortiPortal
- Fortinet FortiPortal
- Information disclosure
Not analysed yet 16 Feb 2023
CVE-2022-41336 CVE record

CVSS 6.6 Medium

Cross-site scripting in Fortinet FortiPortal
- Fortinet FortiPortal
- Cross-site scripting (XSS)
Not analysed yet 3 Jan 2023
CVE-2021-36171 CVE record

CVSS 8.1 High

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the who…
- Fortinet FortiPortal
Not analysed yet 1 Mar 2022
CVE-2021-42757 CVE record

CVSS 6.3 Medium

Buffer overflow in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiDDoS-F
- Memory corruption
Not analysed yet 8 Dec 2021
CVE-2021-36174 CVE record

CVSS 4.3 Medium

A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service attack via specially…
- Fortinet FortiPortal
Not analysed yet 2 Nov 2021
CVE-2021-36176 CVE record

CVSS 6.1 Medium

Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requ…
- Fortinet FortiPortal
Not analysed yet 2 Nov 2021
CVE-2021-32595 CVE record

CVSS 6.5 Medium

Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requ…
- Fortinet FortiPortal
Not analysed yet 2 Nov 2021
CVE-2021-36172 CVE record

CVSS 4.3 Medium

An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consum…
- Fortinet FortiPortal
Not analysed yet 2 Nov 2021
CVE-2021-36181 CVE record

CVSS 3.1 Low

A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated,…
- Fortinet FortiPortal
Not analysed yet 2 Nov 2021
CVE-2021-32602 CVE record

CVSS 5.8 Medium

An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and…
- Fortinet FortiPortal
Not analysed yet 18 Aug 2021
CVE-2021-32588 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated atta…
- Fortinet FortiPortal
Not analysed yet 18 Aug 2021
CVE-2021-32596 CVE record

CVSS 6.0 Medium

A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to de…
- Fortinet FortiPortal
Not analysed yet 4 Aug 2021
CVE-2021-36168 CVE record

CVSS 6.5 Medium

Fortinet FortiPortal: A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in…
- Fortinet FortiPortal
Not analysed yet 4 Aug 2021
CVE-2021-32590 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may all…
- Fortinet FortiPortal
Not analysed yet 4 Aug 2021
CVE-2021-32594 CVE record

CVSS 5.4 Medium

An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to p…
- Fortinet FortiPortal
Not analysed yet 4 Aug 2021
CVE-2017-7340 CVE record

Fortinet FortiPortal: A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below…
- Fortinet FortiPortal
Not analysed yet 25 Mar 2019