Detections
Analytics
CVE-2025-25257
critical
Description
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
References
https://thehackernews.com/2025/07/cisco-warns-of-critical-ise-flaw.html
https://hackread.com/critical-vulnerability-fortinet-fortiweb-cve-2025-25257/
https://thehackernews.com/2025/07/fortinet-releases-patch-for-critical.html
https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce
https://www.securityweek.com/ivanti-fortinet-splunk-release-security-updates/
https://github.com/Aashray99/sql-injection-research-paper
https://github.com/jim2478/CVE-Archive
https://github.com/NetHydra/RAW-CVE
https://github.com/lytianahkone-boop/cve-2025-25257
https://github.com/JackMicalli/CVE-2025-25254
https://github.com/onelittlectfer/CVE-2025-25253
https://github.com/iptables6cv/CVE-2025-25252-POC
https://github.com/imbas007/CVE-2025-25257
https://github.com/adilburaksen/CVE-2025-25257-Exploit-Tool
https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257
Details
Published: 2025-07-17
Updated: 2026-02-20
Known Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: Critical
CVSS v3
Base Score: 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: Critical
EPSS
EPSS: 0.99772
Vulnerability Watch
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability of Interest