CVE Watch—

CVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

CVSS

—

Sem CVSS

EPSS

99.9%

p100

KEV

SIM

18 de jul. de 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

99.8%EPSS · 30 dias99.9%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Fortinet / FortiWeb

Vulnerabilidade

Fortinet FortiWeb SQL Injection Vulnerability

Adicionado ao KEV

18 de jul. de 2025

Corrigir até

8 de ago. de 2025

Uso conhecido em ransomware

Não

Descrição resumida

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Ação necessária

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2025-580347.2 ALT

99.0%

KEV—80Fortinet FortiWeb OS Command Injection Vulnerability18d CVE-2025-644469.8 CRÍ

99.8%

KEV—80Fortinet FortiWeb Path Traversal Vulnerability18d