Vulnerabilities

CVSS

9.4 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

Risk score

100.0

Known exploited

CISA KEV

Published

2025-11-14

Status

Published

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Weaknesses

CWE-23

Coverage 1

malware

New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

A new remote access trojan (RAT) called ChocoPoC is targeting vulnerability researchers through deceptive proof-of-concept (PoC) repositories on GitHub. The malware, disguised within Python dependencies, steals sensitive…

The Hacker News · Jul 2, 2026 High

CVE-2025-64446CVE-2025-55182CVE-2025-14847KRproof-of-conceptremote access trojangithub

All articles mentioning it

Advisories and references

• fortiguard.fortinet.com/psirt/FG-IR-25-910
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
• github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass