CVE-2019-16151

score

<0.1

cvss

4.7

epss

0.4%

published

2025-03-21

kev added

—

first seen

2026-10-21

FortiOS 6.4.1 and below, 6.2.9 and below contain a reflected cross-site scripting caused by improper neutralization of input during web page generation in the 'Host' header, letting remote unauthenticated attackers redirect users or execute JavaScript, exploit requires web filtering and category override enabled.