CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability. Fortinet

Fortinet FortiWeb SQL Injection Vulnerability. Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

• CISA KEV-listed (remediation due 2025-08-08)
• EPSS 99.8% (100.0% percentile)
• CVSS 9.8 critical

Related briefings

• Kazakh-linked spies stalk CIS ministries over water and fuel 2026-10-14

Browse the CVE database

Read the full analysis on IntelFusions