CVE-2023-34986

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-349878.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349888.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349898.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-34994.8The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, whi CVE-2023-349909.8A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized c CVE-2023-349919.8A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and CVE-2023-349929.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to e CVE-2023-349939.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349944.3An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OA CVE-2023-349959.8There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the CVE-2023-349977.8Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an auth CVE-2023-349988.1An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specia