CVE-2025-59669

MediumCVSS 5.5/10Last modified Oct 18, 2026

Description

A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with shell access to the device to connect to redis service and access its data

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-59675.3A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan N CVE-2025-596819.8An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySe CVE-2025-596826.5An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, u CVE-2025-596839.1Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office CVE-2025-596848.8DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.CVE-2025-596855.3Kazaar 1.25.12 allows a JWT with none in the alg field.CVE-2025-596866.5Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.CVE-2025-596874.3IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and noti CVE-2025-596896.1Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been release CVE-2025-59698.8A vulnerability has been found in D-Link DIR-632 FW103B08 and classified as critical. Affected by this vulnerability is the function FUN_004 CVE-2025-596913.7PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi CVE-2025-596923.7PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply