Vulnerability Database

311,379

Total vulnerabilities in the database

CVE-2019-16151

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override enabled/configured.

  • Published: Mar 21, 2025
  • Updated: Nov 9, 2025
  • CVE: CVE-2019-16151
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 4.7
  • AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
fortinet / fortios 6.2.0 6.2.10
fortinet / fortios 6.4.0 6.4.2