CVE-2026-33739CWE-79

FOG has Stored XSS in Multiple Management Pages

Medium · published March 27, 2026

CVSS v3.1

5.7

EPSS

Percentile

18.8

In the wild

Unconfirmed

What it is

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing tables on multiple management pages (Host, Storage, Group, Image, Printer, Snapin) are vulnerable to Stored Cross-Site Scripting (XSS), due to insufficient server-side parameter sanitization in record creations/updates and a lack of HTML escaping in listing tables. Version 1.5.10.1812 patches the issue.

The record

Technical detail

CVSS v3.1: 5.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00274 · 18.8th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-03-27T19:45Z

EPSS history

Timeline

27 MAR 19:45Z
FOG has Stored XSS in Multiple Management Pages
cvelistv5