> Authenticated SQL injection in API endpoint
[DATE: 13/01/2026 08:00]
[LANGUAGE: EN]
CVSSv3 Score:
6.8
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
Revised on 2026-01-13 00:00:00