{"basis":"claimed","id":"CVE-2025-25257","name":"Fortinet FortiWeb SQL Injection Vulnerability","vendorProject":"Fortinet","product":"FortiWeb","publishedAt":"2025-07-17","cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-07-18","dueDate":"2025-08-08","ransomware":false},"epss":{"score":0.99921,"percentile":0.99968,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-07-28","daysToRule":11},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-08-15","daysToRule":29},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.","cwes":["CWE-89"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-07-28","firstIsNew":true,"daysToRule":11,"daysAtMost":null,"freePlan":false,"claims":[{"id":"6bc1d195d9b3c15104717023a0c90ce70dc19ab5fea80de4837e7dd30aaae6ec","cve_id":"CVE-2025-25257","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"2e6c4d02f42a4c3ca90649d50cb13e1d","rule_name":"Fortinet FortiWeb - Remote Code Execution - CVE:CVE-2025-25257","change":"new","default_action":"Block","published_on":"2025-07-28","source_url":"https://developers.cloudflare.com/changelog/post/2025-07-28-waf-release/","source_title":"WAF Release - 2025-07-28","excerpt":"Fortinet FortiWeb - Remote Code Execution - CVE:CVE-2025-25257. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.350Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-08-15","firstIsNew":true,"daysToRule":29,"daysAtMost":null,"freePlan":false,"claims":[{"id":"52c49b6bb2044e980321e5519ad4a681154cbd0f213c40c8571a2746e626bcad","cve_id":"CVE-2025-25257","vendor":"f5","product":"Attack signatures","rule_id":"200102185","rule_name":"Fortinet FortiWeb Pre-Auth SQL Injection","change":"new","default_action":null,"published_on":"2025-08-15","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200102185 \"Fortinet FortiWeb Pre-Auth SQL Injection\" (SQL-Injection, risk High), systems: Other Web Server. References: CVE-2025-25257.","first_seen_at":"2026-11-02T21:00:25.702Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:40.939Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2025-25257","templatePath":"http/cves/2025/CVE-2025-25257.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2025-25257","templatePath":"http/cves/2025/CVE-2025-25257.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}