PT-2026-62111 · Fogproject · Fogproject
CVE-2026-47689
·
Published
2026-07-21
·
Updated
2026-07-21
CVSS v3.1
4.6
Medium
| Vector | AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the
buildRow() method in fogpage.class.php substitutes data values into HTML table cell templates using str replace() without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. sysproduct, sysserial) to /service/inventory.php, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fogproject