CVE-2026-47687 Details
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
A stored cross-site scripting vulnerability has been identified in FOG Project, an open-source cloning and inventory management system, prior to versions 1.5.10.1832 and 1.6.0-beta.2313. The issue arises in the 'selectForm()' helper within 'fogpage.class.php', where '<option>' labels are rendered using raw, unescaped user input. An unauthenticated attacker who knows the MAC address of a registered host can POST a malicious 'sysproduct' value to '/service/inventory.php', which is then stored in the database. When an administrator accesses the Inventory Report, the injected payload escapes the '<option>' element and executes arbitrary JavaScript in the admin's browser. This vulnerability could lead to session hijacking, unauthorized admin actions, or data exfiltration.
Users can update to FOG versions 1.5.10.1832 or 1.6.0-beta.2313 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fogproject fogproject | < 1.5.10.1832 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |