CVE-2026-47685CWE-79cross-site-scripting

CVE-2026-47685

High · published July 22, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-22T01:16Z
Affected products (1)
ProductVersionsFixed in
fogproject/fogproject< 1.5.10.18321.5.10.1832
References (1)
https://github.com/FOGProject/fogproject/security/advisories/GHSA-2r7m-6mqf-5cc4 · [email protected]
EPSS history
Timeline
  • 21 JUL 20:37Z
    FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page
    cvelistv5