CVE-2025-25257

KEV

Updated Feb 26, 2026 · PUBLISHED

Description

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Full record on cve.org →

Affected packages

Package	Vendor / Product	Version range	Status
FortiWeb	Fortinet / FortiWeb	>= 7.0.0, <= 7.0.10	affected
FortiWeb	Fortinet / FortiWeb	>= 7.2.0, <= 7.2.10	affected
FortiWeb	Fortinet / FortiWeb	>= 7.4.0, <= 7.4.7	affected
FortiWeb	Fortinet / FortiWeb	>= 7.6.0, <= 7.6.3	affected