CVE · Exploited · On CISA KEV

CVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

9.8: CVSS 3.1
1: story
JUL 18: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Fortinet
Product: FortiWeb
Published: Jul 17, 2025
Added to KEV: Jul 18, 2025
KEV deadline: Aug 8, 2025
Ransomware use: Unknown
Weakness: CWE-89

What it is

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

NOV 17
VulnerabilitiesFortinet CVE-2025-64446 Under Active AttackThat vulnerability (CVE-2025-64446) affects several versions of FortiWeb and CISA has added it to its Known Exploited Vulnerabilities catalog.DENNIS FISHER · 2 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryfortiguard.fortinet.com/psirt/FG-IR-25-151 Exploitpacketstorm.news/files/id/210193 Exploitexploit-db.com/exploits/52473 Analysisgithub.com/0xbigshaq/CVE-2025-25257