CVE Watch—

CVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

CVSS

—

Sin CVSS

EPSS

96.7%

p100

KEV

SÍ

18 jul 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

96.7%EPSS · 30 días96.7%

2026-06-302026-07-16

Ficha del catálogo KEV

Producto

Fortinet / FortiWeb

Vulnerabilidad

Fortinet FortiWeb SQL Injection Vulnerability

Añadido a KEV

18 jul 2025

Remediar antes de

8 ago 2025

Uso conocido en ransomware

Descripción resumida

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-64446—

99.8%

KEV—80Fortinet FortiWeb Path Traversal Vulnerability—CVE-2025-58034—

98.9%

KEV—80Fortinet FortiWeb OS Command Injection Vulnerability—