Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.
Missing authentication for destructive operations in FOGProject fogproject (CVE-2026-47688)
The `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. `clearAES` wipes host AES encryption creden...
Fixed in 1.5.10.1832; 1.6.0-beta.2313
Stored XSS via unescaped option label in FOG Project inventory (CVE-2026-47687)
The `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` val...
Fixed in >= 1.5.10.1832; >= 1.6.0-beta.2313
Stored XSS in FOG Project via unauthenticated inventory service endpoint (CVE-2026-47685)
The unauthenticated inventory service endpoint (`/service/inventory.php`) in FOG accepts client-supplied values without sanitization and persists them directly to the database. The Host Management Inventory page subse...
Fixed in >= 1.5.10.1832; >= 1.6.0-beta.2313