Vulnerability Database

319,590

Total vulnerabilities in the database

CVE-2025-54972

An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all versions may allow an attacker to inject headers in the response via convincing a user to click on a specifically crafted link

  • Published: Nov 18, 2025
  • Updated: Jan 15, 2026
  • CVE: CVE-2025-54972
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWEs:

Software From Fixed in
fortinet / fortimail 7.0.0 7.4.6
fortinet / fortimail 7.6.0 7.6.4