Cross-Site Scripting Flaw in FOG Project Imaging System
CVE-2026-47689

4.6MEDIUM

Key Information:

Vendor

Fogproject

Status
Fogproject
Vendor
CVE Published:
21 July 2026

What is CVE-2026-47689?

The FOG Imaging System is susceptible to a Cross-Site Scripting (XSS) vulnerability due to the improper handling of data in the buildRow() method of the fogpage.class.php file. This flaw allows an unauthenticated attacker who knows the MAC address of a registered host to send crafted inventory values that can be stored in the database upon POST request to /service/inventory.php. When an administrator accesses the Group Inventory tab, these malicious entries can execute arbitrary HTML/JavaScript code in the admin's browser, potentially leading to further exploits. Versions 1.5.10.1832 and 1.6.0-beta.2313 have addressed this issue by implementing proper HTML escaping.

Affected Version(s)

fogproject < 1.5.10.1832 < 1.5.10.1832

fogproject < 1.6.0-beta.2313 < 1.6.0-beta.2313

References

https://github.com/FOGProject/fogproject/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.