Known vulnerabilities in FortiPortal

Software: FortiPortal
Software CPE: cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*
Total vulnerabilities: 37
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiPortal FortiPortal is affected by 37 known vulnerabilities: 2 critical, 3 high, 13 medium, 19 low Critical High Medium Low

Vulnerabilities (37)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134003 - Improper Access Control
CVE-2026-49938
CWE-284 Low
No
No
7.2.9, 7.4.8 09.06.2026 SB2026060943
#VU122076 - Stack-based buffer overflow
CVE-2025-15467
CWE-121 High
Available
No
7.4.9 27.01.2026 SB2026012785
SB2026012791
SB2026012792
and 66 more
#VU119427 - Incorrect Authorization
CVE-2025-54838
CWE-863 Low
No
No
7.4.6 09.12.2025 SB2025120943
#VU119426 - Key Management Errors
CVE-2024-40593
CWE-320 Low
No
No
7.0.0 09.12.2025 SB2025120942
#VU111046 - Authorization Bypass Through User-Controlled Key
CVE-2024-45329
CWE-639 Low
No
No
7.0.9, 7.2.6, 7.4.1 11.06.2025 SB2025061111
#VU109039 - Information Exposure Through Log Files
CVE-2025-46777
CWE-532 Low
No
No
7.0.10, 7.2.6, 7.4.2 13.05.2025 SB2025051359
#VU107369 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-52967
CWE-79 Low
No
No
6.0.15 10.04.2025 SB2025041043
#VU107356 - Exposure of sensitive information to an unauthorized actor
CVE-2024-35278
CWE-200 Low
No
No
7.0.9, 7.2.5 10.04.2025 SB2025041034
#VU103830 - Improper Resolution of Path Equivalence
CVE-2025-24470
CWE-41 Medium
No
No
7.0.12, 7.2.7, 7.4.3 11.02.2025 SB20250211156
#VU100781 - Improper Certificate Validation
CVE-2024-40590
CWE-295 Medium
No
No
7.0.9, 7.2.5, 7.4.1 21.11.2024 SB2024112166
#VU100401 - Improper Authentication
CVE-2024-26011
CWE-287 Medium
No
No
6.0.15 12.11.2024 SB20241112152
SB20241112154
SB20241112155
and 3 more
#VU100398 - Authorization Bypass Through User-Controlled Key
CVE-2023-47543
CWE-639 Medium
No
No
7.0.4 12.11.2024 SB20241112150
#VU93941 - Authorization Bypass Through User-Controlled Key
CVE-2024-21759
CWE-639 Low
No
No
7.0.7, 7.2.1 09.07.2024 SB2024070991
#VU91756 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-31495
CWE-89 Low
No
No
7.0.7, 7.2.1 11.06.2024 SB20240611272
#VU89583 - Client-Side Enforcement of Server-Side Security
CVE-2023-48789
CWE-602 Low
No
No
6.0.15 16.05.2024 SB2024051612
#VU89564 - Insufficient Verification of Data Authenticity
CVE-2024-23105
CWE-345 Medium
No
No
7.0.7, 7.2.2 15.05.2024 SB2024051535
#VU87527 - Use of Externally-Controlled Format String
CVE-2023-41842
CWE-134 Low
No
No
7.0.0 14.03.2024 SB2024031434
#VU85221 - Authorization Bypass Through User-Controlled Key
CVE-2023-48783
CWE-639 Low
No
No
7.0.7, 7.2.2 09.01.2024 SB2024010981
#VU85219 - Improper Privilege Management
CVE-2023-46712
CWE-269 Low
No
No
7.0.7, 7.2.2 09.01.2024 SB2024010981
#VU84856 - Command injection
CVE-2023-48791
CWE-77 Medium
No
No
7.0.7, 7.2.1 29.12.2023 SB2023122904


Showing elements 1 - 20 out of 37