CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-07-18. EPSS: 99.8% chance of exploitation in the next 30 days.

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Affected products

• Fortinet FortiWeb: from 7.0.0, before 7.0.11 (fixed in 7.0.11); from 7.2.0, before 7.2.11 (fixed in 7.2.11); from 7.4.0, before 7.4.8 (fixed in 7.4.8); from 7.6.0, before 7.6.4 (fixed in 7.6.4)

Published 2025-07-17. Last modified 2026-06-17.