7.9
High
CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
Description
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiAnalyzer Cloud 7.6 | 7.6.2 → 7.6.3 | No fix stated |
| FortiAnalyzer Cloud 7.4 | 7.4.1 → 7.4.7 | No fix stated |
| FortiAnalyzer Cloud 7.2 | 7.2.1 → 7.2.12 | No fix stated |
| FortiAnalyzer 7.6 | 7.6.0 → 7.6.3 | No fix stated |
| FortiAnalyzer 7.4 | 7.4.0 → 7.4.7 | No fix stated |
| FortiAnalyzer 7.2 | 7.2.0 → 7.2.11 | No fix stated |
References
- fortiguard.fortinet.com fortiguard.fortinet.com
Timeline
- Published
- Last modified
Other CVEs of FortiAnalyzer Cloud
The 14 CVEs of FortiAnalyzer Cloud →
CVE-2026-23706
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
5.9
Medium
CVE-2026-23707
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
6.5
Medium
CVE-2025-68649
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…
5.4
Medium
CVE-2025-61848
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet…
6.5
Medium