Fortinac (Fortinet) - vulnerabilities (CVEs)

30 CVEs, 0 in the last 30 days, 79 known versions, newest CVE from 2025-03-14. Vendor: Fortinet.

CVEs of Fortinac

CVE-2023-33300 - CVSS 5.3 (medium), 2025-03-14: A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows…
CVE-2024-31488 - CVSS 9 (critical), 2024-05-14: An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0…
CVE-2023-26206 - CVSS 6.8 (medium), 2024-02-15: An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and…
CVE-2023-33299 - CVSS 9.8 (critical), 2023-06-23: A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute…
CVE-2023-22633 - CVSS 7.5 (high), 2023-06-13: An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and…
CVE-2022-39946 - CVSS 7.6 (high), 2023-06-13: An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions,…
CVE-2023-26203 - CVSS 7.8 (high), 2023-05-03: A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8…
CVE-2023-22637 - CVSS 9 (critical), 2023-05-03: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version…
CVE-2022-45860 - CVSS 7.5 (high), 2023-05-03: A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all…
CVE-2022-45859 - CVSS 4.4 (medium), 2023-05-03: An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all…
CVE-2022-45858 - CVSS 7.4 (high), 2023-05-03: A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0…
CVE-2022-43950 - CVSS 4.7 (medium), 2023-05-03: A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions,…
CVE-2022-43951 - CVSS 7.5 (high), 2023-04-11: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11…
CVE-2022-40676 - CVSS 7.5 (high), 2023-03-07: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through…
CVE-2022-39953 - CVSS 7.8 (high), 2023-03-07: A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8,…
CVE-2022-40675 - CVSS 7.4 (high), 2023-02-16: Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through…
CVE-2023-22638 - CVSS 7.1 (high), 2023-02-16: Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below,…
CVE-2022-39954 - CVSS 9.1 (critical), 2023-02-16: An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC…
CVE-2022-40678 - CVSS 7.8 (high), 2023-02-16: An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through…
CVE-2022-39952 - CVSS 9.8 (critical), 2023-02-16: A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through…
CVE-2022-40677 - CVSS 8.8 (high), 2023-02-16: A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through…
CVE-2022-38376 - CVSS 6.1 (medium), 2023-02-16: Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before…
CVE-2022-38375 - CVSS 9.8 (critical), 2023-02-16: An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform…
CVE-2022-26117 - CVSS 8.8 (high), 2022-07-18: An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and…
CVE-2022-26116 - CVSS 8.8 (high), 2022-05-11: Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2…
CVE-2021-43065 - CVSS 7.8 (high), 2021-12-09: A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker…
CVE-2021-41021 - CVSS 7.8 (high), 2021-12-08: A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via…
CVE-2021-24011 - CVSS 7.2 (high), 2021-05-10: A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.
CVE-2020-12816 - CVSS 6.1 (medium), 2020-09-24: An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting…
CVE-2019-5594 - CVSS 6.1 (medium), 2019-08-23: An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an…