CVE-2021-36175: Fortinet FortiWeb

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device.

Affected products

• Fortinet FortiWeb: from 6.0.0, before 6.2.4 (fixed in 6.2.4)

Published 2021-10-06. Last modified 2026-06-17.