CVE Watch—

CVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

CVSS

—

No CVSS

EPSS

99.8%

p100

KEV

YES

Jul 18, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

99.8%EPSS · 30 days99.8%

2026-09-162026-10-14

KEV catalog record

Product

Fortinet / FortiWeb

Vulnerability

Fortinet FortiWeb SQL Injection Vulnerability

Added to KEV

Jul 18, 2025

Remediate by

Aug 8, 2025

Known ransomware use

Summary description

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-64446—

99.8%

KEV—80Fortinet FortiWeb Path Traversal Vulnerability—CVE-2025-58034—

99.0%

KEV—80Fortinet FortiWeb OS Command Injection Vulnerability—