UpHeron
All vulnerabilities

Servers and applications

CVE-2019-16151

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override…

Severity
Medium 6.1
Published
21 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.2.10, 6.4.2
Sources
NVD

Affected software

SoftwareAffected versions
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • From 6.2.0 before 6.2.10
  • From 6.4.0 before 6.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-16151
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-16151