EUVD-2026-46414Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Description explicitly states unauthenticated attacker; MAC address is network-discoverable and not a credential, so PR:N overrides the official PR:L; stored XSS in admin context with scope change justifies S:C and high C/I.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm() helper in fogpage.class.php renders <option> labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious sysproduct value to /service/inventory.php, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the <option> element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in FOG Project's inventory reporting pipeline allows an unauthenticated network attacker to inject persistent JavaScript into the admin interface by submitting a crafted sysproduct field to the client-facing /service/inventory.php endpoint using any known registered host MAC address. The payload is persisted to the database and executes in an administrator's browser when they open Reports > Inventory, enabling session hijacking, credential theft, or admin-level actions including host manipulation and imaging pipeline control. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 12th percentile), but the stored nature of the payload and its execution in a privileged admin context make this a meaningful risk for any internet-exposed or internally accessible FOG deployment.
Technical ContextAI
FOG Project is a free, open-source network cloning, imaging, and inventory management system written in PHP, commonly deployed in educational institutions and enterprise IT departments. The vulnerability is rooted in the selectForm() helper method inside fogpage.class.php, which renders <option> HTML elements using raw, unescaped user-controlled data - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting) defect. The inventory submission endpoint /service/inventory.php is designed to accept telemetry from FOG-registered client hosts, including hardware metadata fields such as sysproduct. The endpoint authenticates client submissions using the host's MAC address rather than a session credential, meaning any party who knows a registered MAC can impersonate that host and submit arbitrary field values. These values are stored in the database without sanitization and later rendered by the vulnerable selectForm() helper in the admin Reports > Inventory view, bypassing output encoding entirely. The affected product scope per CPE is cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*, covering all releases prior to the patched stable (1.5.10.1832) and beta (1.6.0-beta.2313) versions.
RemediationAI
Upgrade FOG Project to version 1.5.10.1832 (stable) or 1.6.0-beta.2313 (beta), both of which fix the unescaped output in selectForm() per the vendor advisory at https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2. If immediate upgrade is not feasible, restrict network-level access to /service/inventory.php so that only known FOG client IP ranges or subnets can POST to the endpoint - this prevents unauthenticated external actors from injecting malicious inventory data, though it may interrupt inventory reporting from remote or DHCP-roaming clients. Additionally, administrators should audit existing inventory database records for anomalous or HTML/JavaScript-containing sysproduct values and sanitize or remove them before granting admin-level access to the Reports > Inventory view, as stored payloads from pre-patch submissions remain dangerous until cleaned. Restricting the FOG admin web interface to internal networks or VPN-only access provides a secondary layer of defense against admin-session exploitation even if the injection step succeeds.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today