CVE-2026-47687
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
XSS vulnerability in FOG (open-source cloning/imaging tool) allows an unauthenticated attacker who knows a host's MAC address to inject malicious JavaScript via the sysproduct parameter. The payload executes in the admin's browser when viewing inventory reports.
Risk Assessment
Risk of arbitrary JavaScript execution in the admin's session, potentially leading to data theft or further attacks.
Recommendation
Upgrade FOG to version 1.5.10.1832 or 1.6.0-beta.2313.
Other vulnerabilities in FOG
See all- CVE-2026-47689Medium
FOG prior to versions 1.5.10.1832 and 1.6.0-beta.2313 contains an HTML/JavaScript injection vulnerability. An unauthenticated attacker knowing a host's MAC address can POST malicious inventory values to /service/inventory.php, which are stored in the database. When an admin opens the Group Inventory tab, the payload executes in the admin's browser.
- CVE-2026-47688High
Vulnerability in FOG (imaging/inventory management system). An unauthenticated attacker can remotely wipe AES keys and delete power management tasks via a single HTTP GET request.
- CVE-2026-47685High
Vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders static inventory fields without output encoding, allowing stored XSS in any administrator's browser.
Original NVD description (English source)
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.