CVE-2026-47689

Medium

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

SeverityMedium

CVSS4.6

Exploit probability—

ProductFogproject

PublishedJul 21, 2026

First seenJul 21, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

fogproject fogproject1.5.10.1832 or later

Affected products

Product	Affected versions	Fixed in
fogproject fogproject	v < 1.5.10.1832	1.5.10.1832

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.