Fortinet Fortinet FortiPortal
productEUA product tracked in the threat graph; the vulnerabilities below are known to affect it.
0
KEV-listed
0
public exploit
0
EPSS ≥ 10%
by severity
1critical6high5medium1low
updated 2026-10-29
01
vulnerabilities (13)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2021-32588US | critical9.8OT elevated | — | ||||
A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and u… | ||||||
| CVE-2021-32590US | high8.8 | — | ||||
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2… | ||||||
| CVE-2021-36171US | high8.1 | — | ||||
The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict… | ||||||
| CVE-2021-36168US | medium6.5 | — | ||||
A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and any FortiPortal before… | ||||||
| CVE-2021-32595US | medium6.5 | — | ||||
Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via… | ||||||
| CVE-2021-36172US | high8.1 | — | ||||
An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of… | ||||||
| CVE-2021-36174US | high7.5 | — | ||||
A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service at… | ||||||
| CVE-2021-32594US | high8.1 | — | ||||
An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-p… | ||||||
| CVE-2017-7340US | medium6.1 | — | ||||
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch paramete… | ||||||
| CVE-2021-32602US | medium6.1 | — | ||||
An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 a… | ||||||
| CVE-2021-36176US | medium6.1 | — | ||||
Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via… | ||||||
| CVE-2021-36181US | low3.1 | — | ||||
A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow… | ||||||
| CVE-2021-32596US | high7.5 | — | ||||
A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the p… | ||||||
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-79Improper Neutralization of Input During Web Page Generation3 CVEs
- CWE-22Improper Limitation of a Pathname to a Restricted Directory1 CVEs
- CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)1 CVEs
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization1 CVEs
- CWE-400Uncontrolled Resource Consumption1 CVEs
- CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs
- CWE-611Improper Restriction of XML External Entity Reference1 CVEs
- CWE-640Weak Password Recovery Mechanism for Forgotten Password1 CVEs
03
sources (1)
Which sources assert this record, and when.
- EUEU Vulnerability Database (ENISA)13 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan