An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HFortinet Fortimail
APPFortinet7.2.0 – 7.2.9 (excl.)7.4.0 – 7.4.6 (excl.)7.6.0 – 7.6.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
Related vulnerabilities
CVE-2025-32756CRITICAL9.8⚠ KEVPL ✓same product
Stack-based buffer overflow RCE w produktach Fortinet (FortiMail, FortiVoice i inne)
CVE-2023-47539CRITICAL9.8PL ✓same product
FortiMail: Pominięcie uwierzytelnienia admina przez RADIUS i remote_wildcard
CVE-2021-36166CRITICAL9.8PL ✓same product
Fortinet FortiMail — odgadnięcie tokenu uwierzytelniającego administratora
CVE-2021-24007CRITICAL9.8PL ✓same product
SQL Injection w FortiMail umożliwia zdalne wykonanie kodu bez uwierzytelnienia
CVE-2020-9294CRITICAL9.8PL ✓same product
Pominięcie uwierzytelnienia w FortiMail i FortiVoice — dostęp bez hasła