Fogproject

Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to `/service/inventory.php`. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).

Missing authorization in FOG Project (fogproject) before 1.5.10.1832 and 1.6.0-beta.2313 lets a remote unauthenticated attacker invoke the clearAES and clearPMTasks methods of FOGPage through the public 'client' node endpoint using a single HTTP GET, wiping host AES imaging-encryption credentials and deleting all power-management scheduled tasks. No login, session, or CSRF token is required, so any attacker who can reach the FOG web server can degrade imaging integrity and disrupt scheduled operations. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial GET-based trigger makes weaponization straightforward.

Stored cross-site scripting in FOG Project before 1.5.10.1832 and 1.6.0-beta.2313 lets an unauthenticated attacker who knows any registered host's MAC address inject arbitrary JavaScript that later runs in an administrator's browser. The payload is delivered through an unauthenticated inventory-reporting endpoint and persisted in the database, then fires when an admin views Reports > Inventory. No public exploit identified at time of analysis, and no EPSS or CISA KEV data was supplied, so exploitation is currently theoretical but the attack path is fully described by the vendor advisory.

Stored cross-site scripting in FOG Project (open-source imaging/inventory suite) before 1.5.10.1832 and 1.6.0-beta.2313 lets remote attackers persist malicious script via the unauthenticated /service/inventory.php endpoint, which is rendered unencoded on the Host Management Inventory page and executes in any administrator's browser. Because the injection point requires no authentication and the payload runs in a privileged admin session, an attacker can hijack administrator actions and effectively take over host management. No public exploit identified at time of analysis, and EPSS/KEV data was not provided; the vendor-assigned CVSS is 7.3 (High).

Stored cross-site scripting (XSS) in FOG Project versions prior to 1.5.10.1812 allows authenticated high-privilege administrators to inject malicious scripts into management pages (Host, Storage, Group, Image, Printer, Snapin) through unsanitized record creation/update parameters, which are then executed when other administrators view the listing tables. The vulnerability requires administrative access and user interaction to trigger, resulting in potential session hijacking, credential theft, or lateral movement within the management interface.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FOG is a cloning/imaging/rescue suite/inventory management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FOG is a cloning/imaging/rescue suite/inventory management system. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

FOG is a cloning/imaging/rescue suite/inventory management system. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

FOG is a cloning/imaging/rescue suite/inventory management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.

FOG is a cloning/imaging/rescue suite/inventory management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.