Fortinet FortiWeb SQL Injection Vulnerability

cve CVE-2025-25257 2 sources, 2 claims · Watch

CISA Known Exploited Vulnerabilities writes:
Fortinet FortiWeb SQL Injection Vulnerability Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257 the claim

What each source says

PropertySourceSaidMeans here
Author
author
Exploit-DBMilad Karimi (Ex3ptionaL)
receipt
Source
Exploit-DB
Its words
Milad Karimi (Ex3ptionaL)
Read by
field:author
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Milad Karimi (Ex3ptionaL)",
  "codes": "CVE-2025-25257",
  "date_added": "2026-02-04",
  "date_published": "2026-02-04",
  "date_updated": "2026-02-04",
  "description": "FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution",
  "file": "exploits/multiple/webapps/52473.txt",
  "id": "52473",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—
Cwes
cwes
CISA Known Exploited VulnerabilitiesCWE-89
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
CWE-89
Read by
field:cwes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Due date
due_date
CISA Known Exploited Vulnerabilities2025-08-08
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
2025-08-08
Read by
field:dueDate
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Exploited
exploited
CISA Known Exploited Vulnerabilitiesyes
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
yes
Read by
const:yes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Forensic triage
forensic_triage
CISA Known Exploited Vulnerabilitiesfalse
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
No
Read by
field:forensicTriage
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Known ransomware campaign use
known_ransomware_campaign_use
CISA Known Exploited VulnerabilitiesUnknown
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Unknown
Read by
field:knownRansomwareCampaignUse
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Platform
platform
Exploit-DBmultiple
receipt
Source
Exploit-DB
Its words
multiple
Read by
field:platform
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Milad Karimi (Ex3ptionaL)",
  "codes": "CVE-2025-25257",
  "date_added": "2026-02-04",
  "date_published": "2026-02-04",
  "date_updated": "2026-02-04",
  "description": "FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution",
  "file": "exploits/multiple/webapps/52473.txt",
  "id": "52473",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—
Product
product
CISA Known Exploited VulnerabilitiesFortiWeb
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
FortiWeb
Read by
field:product
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Type
type
Exploit-DBwebapps
receipt
Source
Exploit-DB
Its words
webapps
Read by
field:type
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Milad Karimi (Ex3ptionaL)",
  "codes": "CVE-2025-25257",
  "date_added": "2026-02-04",
  "date_published": "2026-02-04",
  "date_updated": "2026-02-04",
  "description": "FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution",
  "file": "exploits/multiple/webapps/52473.txt",
  "id": "52473",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—
Vendor project
vendor_project
CISA Known Exploited VulnerabilitiesFortinet
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Fortinet
Read by
field:vendorProject
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-25257",
  "cwes": "CWE-89",
  "dateAdded": "2025-07-18",
  "dueDate": "2025-08-08",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257",
  "product": "FortiWeb",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiWeb SQL Injection Vulnerability"
}
—
Verified
verified
Exploit-DBfalse
receipt
Source
Exploit-DB
Its words
0
Read by
field:verified
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Milad Karimi (Ex3ptionaL)",
  "codes": "CVE-2025-25257",
  "date_added": "2026-02-04",
  "date_published": "2026-02-04",
  "date_updated": "2026-02-04",
  "description": "FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution",
  "file": "exploits/multiple/webapps/52473.txt",
  "id": "52473",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "webapps",
  "verified": "0"
}
—

vulnerability

Fortinet FortiWeb SQL Injection Vulnerability
zetlyn/cve-kev · 2025-07-18
cwes CWE-89 due_date 2025-08-08 exploited yes forensic_triage false known_ransomware_campaign_use Unknown product FortiWeb vendor_project Fortinet

exploit

FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
zetlyn/cve-exploitdb · 2026-02-04
author Milad Karimi (Ex3ptionaL) platform multiple type webapps verified false source