CVE-2025-25257

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 7.6.0, <= 7.6.3; >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.10; >= 7.0.0, <= 7.0.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-151Vendor Advisory
https://packetstorm.news/files/id/210193/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/52473Exploit, Third Party Advisory, VDB Entry
https://github.com/0xbigshaq/CVE-2025-25257Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257US Government Resource

Timeline

Published: Jul 17, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Jul 18, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-25268.8The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. Thi CVE-2025-252646.5An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissiv CVE-2025-252654.9A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged rem CVE-2025-252666.1A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All CVE-2025-252675.5A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All CVE-2025-252688.8An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write ac CVE-2025-252698.4An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.CVE-2025-25274.3Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows a CVE-2025-252709.8An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurat CVE-2025-252718.8An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.CVE-2025-252737.8Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow a CVE-2025-252748.8Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allo