Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2025-25257

fortinetfortiweb

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

VTP deterministic threat71.0of 100 · CVSS excluded

VTP analyst assessment

FortiWeb unauthenticated SQL injection

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateCANDIDATE CREATED
AI priorityHIGH
AI confidence84%
Public exploitation · VTP factKEV

Assessment

CISA KEV lists this FortiWeb SQL-injection vulnerability as exploited. Crafted HTTP or HTTPS requests can let an unauthenticated attacker execute unauthorized SQL code or commands. Research reporting identifies public proof-of-concept availability.

Why it matters

  • FortiWeb receives web traffic and may protect applications at the network edge.
  • Successful SQL injection could expose or alter data accessible through the affected component.

Evidence

3 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 1 independent evidence group.

Uncertainties

The supplied research describes a CIS-government campaign but does not establish that it exploited this CVE.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use affected FortiWeb releases, apply Fortinet's remediation and restrict administrative exposure.

AI baseline history (3)
  1. BASELINE ASSESSED
    FortiWeb unauthenticated SQL injectiongpt-5.6-terra · low
  2. BASELINE ASSESSED
    Fortinet FortiWeb SQL injectiongpt-5.6-terra · low
  3. BASELINE ASSESSED
    FortiWeb unauthenticated SQL injectiongpt-5.6-sol · high
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityPOCReliability not implied
EPSS1.00100th percentile · prediction
Evidence confidence78%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    A proof of concept is reported; functional reliability is not established.

  3. 03

    EPSS is 1.00; this is predictive context, not exploitation evidence.

  4. 04

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

POC AVAILABLEPoc Available
RESEARCH PUBLICATIONNew technical research
KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

2publications detected
2underlying evidence chains

1 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimPOC AVAILABLEPUBLICATION REPORTS POC
60%claim confidence
UNKNOWNreport:231933040731c629f2c4975e578f270a050f66be829711f251a7ef3ead8ef63aACTIVE
Evidence
Source claimPOC AVAILABLEPUBLICATION REPORTS POC
78%claim confidence
INDEPENDENTreport:7a669fbafaa7cb3a54f6a8de88cba624617d86260d34dab2f0ce13627c107313ACTIVE
Evidence
04

Event history

Threat timeline

  1. 16:0015 Oct
    POC AVAILABLE

    Poc Available

    The Hacker News supplied a deterministically extracted signal; review the linked evidence before escalation.

  2. 14:0014 Oct
    POC AVAILABLE

    Poc Available

    Cisco Talos supplied a deterministically extracted signal; review the linked evidence before escalation.

  3. 14:0014 Oct
    RESEARCH PUBLICATION

    New technical research

    Cisco Talos published evidence linked to CVE-2025-25257.

  4. 00:0018 Jul
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives

CVE-2025-25257CVE-2025-8088
Separate evidence group
Original
Cisco TalosSECURITY RESEARCHINDEPENDENT

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources and energy.

CVE-2025-25257CVE-2025-8088
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score71.0vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction19.96 / 20
Exploit availability7.5 / 15
Source independence7.5 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-89
CPE records
1
Deterministic history records
20
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.