{"id":"CVE-2025-52970","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-52970","generatedAt":"2026-11-02T16:24:08.656Z","title":"A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device…","description":"A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.","published":"2025-08-12T19:15:32.000Z","lastModified":"2026-06-17T09:37:21.000Z","status":"Analyzed","sourceIdentifier":"psirt@fortinet.com","cvss":{"version":"3.1","score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-233"],"affected":["fortinet/fortiweb"],"epss":{"score":0.10084,"percentile":0.95635,"date":"2026-11-01","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 10.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.10084,"from":0.09746,"percentile":0.9548},"summary":"EPSS moved from 9.7% to 10.1% probability of exploitation in the next thirty days."}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-448","tags":["Vendor Advisory"],"source":"psirt@fortinet.com"},{"url":"https://pwner.gg/blog/2025-08-13-fortiweb-cve-2025-52970","tags":["Exploit","Third Party Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-52970","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}