Stored XSS via unescaped option label in FOG Project inventory (CVE-2026-47687)

The `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, where it is stored in the database. When an administrator opens Reports > Inventory, the payload executes arbitrary JavaScript in the admin's browser. Affected versions: - < 1.5.10.1832 - < 1.6.0-beta.2313 We recommend updating to: >= 1.5.10.1832, >= 1.6.0-beta.2313. CVSS 7.3 · our assessment: this_week Reference: https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2 Details: https://vuln.today/cve/CVE-2026-47687