---
id: "CVE-2025-25257"
kind: "vulnerability"
aliases: ["CVE-2025-25257"]
title: "fortinet fortiweb: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89]\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "fortinet fortiweb", "fixed": ["7.0.11"], "affected": ">= 7.0.0, < 7.0.11", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.2.11"], "affected": ">= 7.2.0, < 7.2.11", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.4.8"], "affected": ">= 7.4.0, < 7.4.8", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": ["7.6.4"], "affected": ">= 7.6.0, < 7.6.4", "ecosystem": "vendor"}, {"name": "Fortinet FortiWeb", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortiweb", "infrastructure", "self-hosted", "waf"]
not_affected_if: ["not-fortiweb"]
published_at: "2025-07-17T16:15:34+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25257", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# fortinet fortiweb: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89]…

Fortinet FortiWeb, a web application firewall, has a SQL injection flaw that lets an unauthenticated remote attacker run unauthorized SQL through crafted HTTP or HTTPS requests. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fortinet fortiweb affected >= 7.0.0, < 7.0.11 fixed 7.0.11
- vendor:fortinet fortiweb affected >= 7.2.0, < 7.2.11 fixed 7.2.11
- vendor:fortinet fortiweb affected >= 7.4.0, < 7.4.8 fixed 7.4.8
- vendor:fortinet fortiweb affected >= 7.6.0, < 7.6.4 fixed 7.6.4
- vendor:Fortinet FortiWeb affected ? fixed ?

## Fix

Apply the mitigations in Fortinet's vendor advisory for CVE-2025-25257; if none are available, discontinue use of the product per CISA's required action.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25257
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-25257

## From the sources

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_