CVE-2025-25257

high-risk
Published 2025-07-17

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Do I need to act?

!
17.2% chance of exploitation in next 30 days
EPSS score — higher than 83% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
52473
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Fortinet

References (5)

Vendor Advisory https://fortiguard.fortinet.com/psirt/FG-IR-25-151
Exploit https://packetstorm.news/files/id/210193/
Exploit https://www.exploit-db.com/exploits/52473
Third Party Advisory https://github.com/0xbigshaq/CVE-2025-25257
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
57
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal