Vulnerabilitycritical

Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025

The Hacker Newsby @TheHackersNewsJul 12, 2025 · 06:33 UTC (Jul 12, 2025)2 min read4 · 2 reads

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-25257 CVE-2025-20286 CVE-2025-20281 CVE-2025-20282

Tags: cve-2025-25257 cve-2025-20286 cve-2025-20281 cve-2025-20282 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-20281 +1 related CVE CVE-2025-20282	Unauthenticated Root RCE via API Injection in Cisco ISE and ISE-PIC	10.0	98%	KEVPoC	Jun 25, 2025 KEV Jul 28, 2025
CVE-2025-20286	A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE)…	9.8	1%		Jun 4, 2025
CVE-2025-25257	Critical Unauthenticated SQL Injection in Fortinet FortiWeb (CVE-2025-25257)	9.8	100%	KEVPoC ×2	Jul 17, 2025 KEV Jul 18, 2025

From the original article

2 min read at thehackernews.com

Fortinet has released fixes for a critical security flaw impacting FortiWeb that could enable an unauthenticated attacker to run arbitrary database commands on susceptible instances. Tracked as CVE-2025-25257, the vulnerability carries a CVSS score of 9. 6 out of a maximum of 10.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.