The FOG Project is vulnerable to a stored cross-site scripting (XSS) attack. The `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. This allows an unauthenticated attacker who knows any registered host's MAC address to POST malicious inventory values to `/service/inventory.php`, which stores them in the databas [truncated]
CVE-2026-47688 is a high-severity vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. An unauthenticated attacker can exploit this vulnerability via a single HTTP GET request to the public 'client' node endpoint, allowing remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks without requiring login, session, or [truncated]
The FOG Project is vulnerable to a high-severity issue, CVE-2026-47687, which allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. This issue arises from the `selectForm()` helper in `fogpage.class.php` rendering `<option>` labels using raw, unescaped user input. An attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to [truncated]
FOG, a free open-source cloning/imaging/rescue suite/inventory management system, has a vulnerability in versions prior to 1.5.10.1832 and 1.6.0-beta.2313. The unauthenticated inventory service endpoint persists client-supplied values without sanitization. The Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that exe [truncated]
