A Vulnerability in FortiWeb Could Allow for SQL Injection

A SQL injection vulnerability (CVE-2025-25257) has been discovered in FortiWeb that may permit unauthenticated attackers to execute SQL commands via crafted HTTP/HTTPS requests; successful exploitation could lead to arbitrary code execution. The report maps the issue to the ATT&CK tactic 'Initial Access' and technique 'Exploit Public-Facing Application (T1190)'. No evidence of in-the-wild exploitation or affected deployments is provided.