CVE Daily

CVE-2025-25257

An improper neutralization of special elements used in an SQL command ('SQL Inje...

Critical CVSS 9.8

Overview

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and below 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

CWE: CWE-89 Published: 2025-07-17T16:15:34.723
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.8 (CRITICAL)
  • Detected tags: sql, unauth_access (tag impact: HIGH)

Recommended actions:

  • Use parameterized queries/ORM (avoid string concatenation).
  • Add WAF rules and input validation.
  • Enforce authentication/authorization; reduce default endpoint exposure.

Recommended tools

Tags