CVE-2020-29015

9.8 criticalEPSS 2.6%

Critical (9.8) in fortinet fortiweb. EPSS 2.6% chance of exploitation in the next 30 days.

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2021-01-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiweb

References

https://www.fortiguard.com/psirt/FG-IR-20-124
https://www.fortiguard.com/psirt/FG-IR-20-124

Check your stack JSON