CVE-2025-25257

CVEs › CVE-2025-25257

Description

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Overview

State: PUBLISHED
Assigner (CNA): fortinet
CVSS severity: CRITICAL
CVSS score: 9.6 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
Effective score: 9.6 / 10 CRITICAL source: CNA overview
CWE(s): CWE-89
Reserved: 2025-02-05
Published: 2025-07-17 17:10 UTC
Last updated: 2026-02-26 18:50 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25257.json
Linked Threat: CVE-2025-25257 — CVE-2025-25257

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: Fortinet FortiWeb SQL Injection Vulnerability
Vendor / project: Fortinet
Product: FortiWeb
Date added to KEV: 2025-07-18
Remediation due: 2025-08-08
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-07-17 16:15:34 UTC
NVD last modified: 2026-06-17 09:00:34 UTC
NVD CVSS v3.1: 9.8 / 10 CRITICAL source: psirt@fortinet.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.9671 (probability of exploitation in next 30 days)
EPSS percentile: 99.88% vs all CVEs — higher = more likely to be exploited, as of 2026-07-12

NVD / KEV / EPSS data refreshed 2026-07-13 13:33 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-21785
Assigner: fortinet
Published: Jul 17, 2025, 3:10:04 PM
Updated: Feb 26, 2026, 5:50:29 PM
EUVD base score (CVSS 3.1): 9.6 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
EUVD-reported EPSS: 26.2000
Vendors: Fortinet
Products: FortiWeb (7.2.0 ≤7.2.10)

FortiWeb (7.4.0 ≤7.4.7)

FortiWeb (7.0.0 ≤7.0.10)

FortiWeb (7.6.0 ≤7.6.3)
Aliases: GHSA-mj4r-rpwm-gg33

ENISA description: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

EUVD references (1)

https://fortiguard.fortinet.com/psirt/FG-IR-25-151

Affected products (1)

Vendor	Product	Versions	Platforms
Fortinet	FortiWeb	`7.6.0` (affected), `7.4.0` (affected), `7.2.0` (affected), `7.0.0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://fortiguard.fortinet.com/psirt/FG-IR-25-151

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/89.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2025-25257 rapid7:attackerkb.com
https://fortiguard.fortinet.com/psirt/FG-IR-25-151 rapid7:fortiguard.fortinet.com
https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/ rapid7:labs.watchtowr.com
https://www.cve.org/CVERecord?id=CVE-2025-25257 rapid7:www.cve.org

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://fortiguard.fortinet.com/psirt/FG-IR-25-151 psirt@fortinet.com Vendor Advisory
https://github.com/0xbigshaq/CVE-2025-25257 134c704f-9b21-4f2e-91b3-4a467353bcc0 Third Party Advisory
https://packetstorm.news/files/id/210193/ af854a3a-2127-422b-91ae-364da2661108 ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
https://www.exploit-db.com/exploits/52473 af854a3a-2127-422b-91ae-364da2661108 ExploitThird Party AdvisoryVDB Entry

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Windows 11, version 23H2 known issues and notifications

web:learn.microsoft.com

As of November 11, 2025 , Home and Pro editions of Windows 11, version 23H2 have reached end of servicing. Enterprise and Education editions of version 23H2 will continue to receive monthly security updates until November 10, 2026.

2026-08-31 12:02 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-08-31 12:02 UTC
Patch Tuesday Vulnerability Insights - Action1

web:www.action1.com

Patch Tuesday is a scheduled release day for software patches, primarily used by Microsoft, to fix security vulnerabilities, bugs, and performance issues in its software products like Windows, Office, and Azure. It occurs monthly and aims to standardize the process of delivering security updates to ensure devices remain protected.

2026-08-31 12:02 UTC
August 2025 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.

2026-08-31 12:02 UTC
Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find

web:www.cvefind.com

CVE Find is a real-time vulnerability database indexing 384 736 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 2784 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).

2026-08-31 12:02 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-08-31 12:02 UTC
Release Notes - Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-08-31 12:02 UTC
Patch Tuesday 2025 Year In Review | Tenable®

web:www.tenable.com

Key takeaways: Microsoft's 2025 Patch Tuesday releases addressed 1,130 CVEs . This is the second year in a row where the CVE count was over 1,000. Elevation of Privilege vulnerabilities accounted for 38.3% of all Patch Tuesday vulnerabilities in 2025 , followed by Remote Code Execution flaws at 30.8%. 41 zero-day vulnerabilities were addressed across all Patch Tuesday releases in 2025 , including ...

2026-08-31 12:02 UTC
CVE Record: CVE-2025-25257

web:www.cve.org

Vulnerability detail for CVE-2025-25257 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Learn more here.

2026-05-22 12:43 UTC
CVE-2025-25257: Fortinet FortiWeb SQL Injection Flaw - SentinelOne

web:www.sentinelone.com

CVE-2025-25257 is a SQL injection vulnerability in Fortinet FortiWeb. Learn about its impact, affected versions, and mitigation methods.

2026-05-22 12:43 UTC
Patch immediately: CVE-2025-25257 PoC enables remote code execution on ...

web:securityaffairs.com

Fortinet urges users to patch . Proof-of-concept (PoC) exploits for CVE-2025-25257 in Fortinet FortiWeb (CVSS 9.8) enable pre-auth RCE on vulnerable servers. The flaw is a SQL injection vulnerability in FortiWeb (CWE-89) that allows unauthenticated attackers to execute unauthorized SQL commands via crafted HTTP/HTTPS requests.

2026-05-22 12:43 UTC
CVE-2025-25257 - Exploits & Severity - Feedly

web:feedly.com

Threat Intelligence Report CVE-2025-25257 is a critical SQL injection vulnerability in Fortinet's FortiWeb products, with a CVSS score of 9.6, allowing unauthenticated attackers to execute arbitrary SQL commands via crafted HTTP/HTTPS requests. There is no mention of active exploitation or proof-of-concept exploits in the provided article, but mitigation includes disabling the HTTP/HTTPS ...

2026-05-22 12:43 UTC
CVE-2025-25257: SQL Injection to Root RCE in FortiWeb's - Fidelis Security

web:fidelissecurity.com

Learn about CVE - 2025 -25257—systems affected, exploitation method, root cause, detection, and urgent mitigation steps to secure your environment.

2026-05-22 12:43 UTC
Nvd - Cve-2025-25257

web:nvd.nist.gov

This is a potential security issue, you are being redirected to https://nvd.nist.gov

2026-05-22 12:43 UTC
Patch - Everything Local: Breaking News, Events, Discussions

web:patch.com

The best breaking news, stories, and events from the Patch network of local news sites

2026-05-22 12:43 UTC
FortiWeb SQL Injection Vulnerability Allows Attacker to Execute ...

web:cybersecuritynews.com

Patch immediately and disable admin interfaces as a precaution. The vulnerability has been assigned CVE-2025-25257 and carries a CVSS v3 score of 9.6, indicating its critical severity level.

2026-05-22 12:43 UTC
Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb ...

web:thehackernews.com

Fortinet fixes a critical SQL injection vulnerability in FortiWeb ( CVE-2025-25257 ), posing risks to database security.

2026-05-22 12:43 UTC
Fortinet FortiWeb Unauthenticated SQL Injection Vulnerability (CVE-2025 ...

web:threatprotect.qualys.com

Kentaro Kawane from GMO Cybersecurity discovered a vulnerability of critical severity impacting FortiWeb. Tracked as CVE-2025-25257 , the vulnerability has a CVSS score of 9.6. Upon successful exploitation of the vulnerability, an unauthenticated attacker can execute unauthorized SQL code via crafted HTTP or HTTPS requests. FortiWeb is a web application firewall (WAF) designed to protect web ...

2026-05-22 12:43 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-25257.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25257",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T03:55:34.282924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-07-18",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:50:29.556Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/0xbigshaq/CVE-2025-25257"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-07-18T00:00:00.000Z",
            "value": "CVE-2025-25257 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:41:15.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.exploit-db.com/exploits/52473"
          },
          {
            "url": "https://packetstorm.news/files/id/210193/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWeb",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.3",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.7",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.10",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.10",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T10:54:38.917Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiWeb version 7.6.4 or above\nUpgrade to FortiWeb version 7.4.8 or above\nUpgrade to FortiWeb version 7.2.11 or above\nUpgrade to FortiWeb version 7.0.11 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2025-25257",
    "datePublished": "2025-07-17T15:10:04.532Z",
    "dateReserved": "2025-02-05T13:31:18.868Z",
    "dateUpdated": "2026-02-26T17:50:29.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}