Fortinet FortiWeb SQL Injection Vulnerability
CVSS score
—
EPSS probability
%99.8
Risk score
—
Published
1 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
Nuclei: Fortinet FortiWeb - SQL Injection
PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.
Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.
This repository provides production-ready detection engineering content for **CVE-2025-25257**, a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. Successful exploitation can lead to Remote Code Execution without any prior authentication.
CVE‑2025‑25257 is a critical pre-authentication SQL injection vulnerability affecting Fortinet FortiWeb’s
CVE-2025-25257 PoC for educational use and/or authorised pentesting.
A working (at least for me :] ) exploit for CVE-2025-25257
Public PoC for CVE-2025-25257: FortiWeb pre-auth SQLi to RCE
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-25257"