EUVD-2026-46417Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AV:A reflects the internally-facing inventory endpoint; PR:N because no authentication is required to POST inventory data; UI:R because the XSS payload only fires when an admin views the Group Inventory tab.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow() method in fogpage.class.php substitutes data values into HTML table cell templates using str_replace() without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. sysproduct, sysserial) to /service/inventory.php, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
AnalysisAI
Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to /service/inventory.php. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network adjacency to the FOG server's HTTP service (AV:A) - `/service/inventory.php` is an internally-facing endpoint, so purely internet-origin exploitation is blocked unless the endpoint is explicitly exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.6 (Medium) reflects an adjacent network vector (AV:A), no authentication required to submit payloads (PR:N), and a mandatory administrator interaction trigger (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same network segment as the FOG server performs ARP scanning to discover the MAC address of a registered imaging host, then sends a crafted HTTP POST to `/service/inventory.php` with a JavaScript payload embedded in the `sysproduct` field. The malicious value is stored in the FOG database without sanitization, and when an administrator next opens the Group Inventory tab, the payload executes silently in the admin's browser, allowing the attacker to exfiltrate the session token or perform actions within the admin interface. … |
| Remediation | Upgrade FOG Project to version 1.5.10.1832 (stable) or 1.6.0-beta.2313 (beta), which introduce HTML escaping in the `buildRow()` rendering path; details are at https://github.com/FOGProject/fogproject/security/advisories/GHSA-fqgf-j2gh-92cm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today