CVE-2024-50569

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-50579.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Inje CVE-2024-505705.0A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 t CVE-2024-505717.2A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7 CVE-2024-505727.2A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-505735.4In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services CVE-2024-505747.5In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality CVE-2024-505756.1In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API CVE-2024-505765.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest CVE-2024-505775.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings CVE-2024-505785.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page CVE-2024-505796.1In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible CVE-2024-50585.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows