Critical severity · published Jul 17, 2025
CVE-2025-25257
Fortinet FortiWeb SQL Injection Vulnerability
In wildKEV
9.8
CVSS
99.9%
EPSS
Yes
On KEV
Description
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 18, 2025
Federal remediation dueAug 8, 2025
Ransomware campaign useNot known
Affected products
Which versions
FO
FortiWeb · Fortinet
7.6.0 through 7.6.3; 7.4.0 through 7.4.7; 7.2.0 through 7.2.10; 7.0.0 through 7.0.10 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-25257
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
fortiguard.fortinet.com
https://fortiguard.fortinet.com/psirt/FG-IR-25-151
More from FortiWeb
9.8
CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
9.8
CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability
7.2
CVE-2025-58034
Fortinet FortiWeb OS Command Injection Vulnerability
9.8
CVE-2026-26035
An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb…
9.8
CVE-2025-59719
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an…