CVE-2019-16149 Cross-site scripting in FortiClientEMS

What is CVE-2019-16149?

CVE-2019-16149 is a medium-severity cross-site scripting vulnerability in Fortinet FortiClientEMS, published on 28 Mar 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system.

Weakness: CWE-79

Which versions are affected by CVE-2019-16149?

It affects 1 product.

Products include Fortinet Forticlientems.

How do I fix CVE-2019-16149?

No fix has been published for CVE-2019-16149 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-16149 being exploited?

There is no known exploitation of CVE-2019-16149 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiClientEMS

• CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Exploited Critical 9.1
• CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Exploited Critical 9.1
• CVE-2024-23106 Auth bypass in FortiClientEMS High 7.7
• CVE-2025-59922 SQL injection in FortiClientEMS Medium 6.8
• CVE-2026-59836 Security feature bypass in FortiClientEMS Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j8c2-6298-q92j.