PATCH IMMEDIATELY: CVE-2025-25257 POC ENABLES REMOTE CODE EXECUTION ON FORTINET FORTIWEB

Summary from the TLDR InfoSec newsletter

A serious SQL injection vulnerability (CVE-2025-25257) has been identified in Fortinet FortiWeb. The flaw allows unauthenticated attackers to execute remote code by writing malicious files to the server's filesystem, potentially leading to full remote code execution. Fortinet has issued patches for versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11. Immediate application of these updates is strongly recommended due to publicly available exploits.