Stored XSS in FOG Project via unauthenticated inventory service endpoint (CVE-2026-47685)

The unauthenticated inventory service endpoint (`/service/inventory.php`) in FOG accepts client-supplied values without sanitization and persists them directly to the database. The Host Management Inventory page subsequently renders these stored values into HTML without output encoding, enabling an unauthenticated attacker to inject persistent JavaScript that executes in any administrator's browser upon viewing the inventory page. Affected versions: - < 1.5.10.1832 - < 1.6.0-beta.2313 We recommend updating to: >= 1.5.10.1832, >= 1.6.0-beta.2313. CVSS 7.3 · our assessment: this_week Reference: https://github.com/FOGProject/fogproject/security/advisories/GHSA-2r7m-6mqf-5cc4 Details: https://vuln.today/cve/CVE-2026-47685