CVE-2023-34991

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-349929.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to e CVE-2023-349939.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349944.3An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OA CVE-2023-349959.8There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the CVE-2023-349977.8Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an auth CVE-2023-349988.1An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specia CVE-2023-349997.2A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker CVE-2023-35006.1An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before CVE-2023-350017.8Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any CVE-2023-350029.8A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A specially crafted malformed f CVE-2023-350037.8Path transversal in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation o CVE-2023-350047.8An integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt