Vulnerability Database

311,379

Total vulnerabilities in the database

CVE-2025-54972

An improper neutralization of crlf sequences ('crlf injection') in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all versions may allow an attacker to inject headers in the response via convincing a user to click on a specifically crafted link

  • Published: Nov 18, 2025
  • Updated: Nov 19, 2025
  • CVE: CVE-2025-54972
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWEs:

Software From Fixed in
fortinet / fortimail 7.0.0 7.4.6
fortinet / fortimail 7.6.0 7.6.4