Fortinet FortiWeb SQL Injection Vulnerability
Fortinet — FortiWeb
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
9.8
99.8%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- Jul 17, 2025
- Modified
- Jun 17, 2026
- Added to KEV
- Jul 18, 2025
- Federal patch due
- Aug 8, 2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
8 foundWeaponization
Public repositories whose name or description references CVE-2025-25257, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257★ 100
updated Sep 25, 2026
- 0xbigshaq/CVE-2025-25257★ 64
FortiWeb CVE-2025-25257 exploit
updated Feb 28, 2026
- TheStingR/CVE-2025-25257★ 5
Public PoC for CVE-2025-25257: FortiWeb pre-auth SQLi to RCE
updated Jan 26, 2026
- 0xgh057r3c0n/CVE-2025-25257★ 2
PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.
updated Oct 11, 2026
- aitorfirm/CVE-2025-25257★ 1
Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.
updated Oct 11, 2025
- imbas007/CVE-2025-25257★ 1
updated Sep 24, 2025
- mrmtwoj/CVE-2025-25257★ 1
CVE‑2025‑25257 is a critical pre-authentication SQL injection vulnerability affecting Fortinet FortiWeb’s
updated May 18, 2026
- segfault-it/CVE-2025-25257★ 1
A working (at least for me :] ) exploit for CVE-2025-25257
updated Apr 29, 2026
References
How this class of flaw gets exploited
Frequently asked questions
What is CVE-2025-25257?
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
How severe is CVE-2025-25257?
CVE-2025-25257 has a CVSS base score of 9.8 out of 10 (CVSS 3.1).
Is CVE-2025-25257 actively exploited in the wild?
Yes. CVE-2025-25257 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Jul 18, 2025, meaning CISA has confirmed evidence of active exploitation.
What is the EPSS score for CVE-2025-25257?
99.8% - meaning FIRST.org's EPSS model estimates a 99.8% probability this vulnerability will be exploited in the wild within 30 days (100% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2025-25257?
Yes - a public Nuclei template referencing CVE-2025-25257 exist in public repositories we checked. We also found 8 public GitHub repositories referencing this CVE.
What type of vulnerability is CVE-2025-25257?
CVE-2025-25257 is classified under CWE-89 (Execute unauthorized code or commands).
Cross-checked against
Impactr finds and proves whether CVE-2025-25257 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist