CoreCVE
Back

MEDIUM

An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system

Published Mar 28, 2025

Description

An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system.

Affected products

Remediation

Vendor solution

Please upgrade to version 6.2.1 and above.

Metrics

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner fortinet
Published Mar 28, 2025
Updated Mar 28, 2025
Reserved Sep 9, 2019
Link CVE-2019-16149
CISA Vulnrichment
Updated Mar 28, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2019-16149
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-16149