← CVE Radar
CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
9.8 CRITICALEPSS 99.92%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.6 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RC:C |
CISA required action
⚡ Known exploited · remediation due Aug 8, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-25257
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Jul 17, 2025
- Last modified
- 2026-06-17 09:00 UTC
- Weaknesses
- CWE-89 · Execute unauthorized code or commands
Affected Products
As published by the CNA in the CVE record.
FortinetFortiWeb4 version ranges
- 7.6.0 through 7.6.3
- 7.4.0 through 7.4.7
- 7.2.0 through 7.2.10
- 7.0.0 through 7.0.10
References
- fortiguard.fortinet.com https://fortiguard.fortinet.com/psirt/FG-IR-25-151
- packetstorm.news https://packetstorm.news/files/id/210193/
- exploit-db.com https://www.exploit-db.com/exploits/52473
- github.com https://github.com/0xbigshaq/CVE-2025-25257
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257