CVE-2026-47689 Details
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
A stored cross-site scripting vulnerability has been identified in FOG Project, an open-source cloning and inventory management system, prior to versions 1.5.10.1832 and 1.6.0-beta.2313. The issue arises in the 'buildRow()' method of 'fogpage.class.php', where data is inserted into HTML table cell templates using 'str_replace()' without proper HTML escaping. This flaw allows an unauthenticated attacker who knows the MAC address of a registered host to POST malicious inventory values to 'inventory.php', which are then saved in the database. When an administrator accesses the Group Inventory tab, the injected payload is executed as HTML or JavaScript in the admin's browser.
Users can update to FOG versions 1.5.10.1832 or 1.6.0-beta.2313, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOGProject/fogproject/security/advisories/GHSA-fqgf-j2gh-92cm | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fogproject fogproject | < 1.5.10.1832 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |