Fortinet FortiWeb SQL Injection Vulnerability

Description

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-151
• https://nvd.nist.gov/vuln/detail/CVE-2025-25257

Additional Information

Catalog Version

2025.07.18

Catalog Released

July 18, 2025

Days Until Due

13 days

Last Updated

1 week ago