On Thursday, Fortinet released an update for FortiWeb. Exploits have emerged that abuse the critical gap.

Fortinet fixes a critical SQL injection vulnerability in FortiWeb (CVE-2025-25257), posing risks to database security.

Proof-of-concept exploits have been released for a critical SQLi vulnerability in Fortinet FortiWeb that can be used to achieve pre-authenticated remote code execution on vulnerable servers.

SQL injection occurs when user-supplied input is not escaped properly when it is inserted into an SQL statement. Since single quotes (') are used to delimit string literals, proper handling is ...

Example: SQL injection. If an application dynamically constructs SQL queries using user input and modifies them at runtime, an attacker can inject malicious SQL commands to change the behavior of ...