PT-2026-62111 · Fogproject · Fogproject
CVE-2026-47689
·
Publicado
2026-07-21
·
Atualizado
2026-07-21
CVSS v3.1
4.6
Média
| Vetor | AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the
buildRow() method in fogpage.class.php substitutes data values into HTML table cell templates using str replace() without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. sysproduct, sysserial) to /service/inventory.php, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fogproject