Vulnerabilities

TI-2026-35193 CVE-2026-47689

FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

LOW 23

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.2 Adjacent network No auth User interaction EPSS 0.00266 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-79

TI-2026-35192 CVE-2026-47688

Missing authorization in fogproject

HIGH 75

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00267 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-862

TI-2026-35191 CVE-2026-47687

FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

HIGH 73

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00406 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-79

TI-2026-35189 CVE-2026-47685

FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

MEDIUM 40

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00372 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-79

TI-2026-26118 CVE-2026-33739

FOG has Stored XSS in Multiple Management Pages

MEDIUM 59

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.7 Network High privileges User interaction EPSS 0.0019 Published 2026-03-27 Fixed in 1.5.10.1812 CWE-79

TI-2025-36201 CVE-2025-58443

FOG's authentication bypass leads to full SQL DB dump

HIGH 82

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.21291 Published 2025-09-06 No fix listed CWE-287

TI-2024-28336 CVE-2024-42349

FOG has a Log Information Disclosure

MEDIUM 63

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00568 Published 2024-08-02 Fixed in 1.5.10.47 CWE-532

TI-2024-28335 CVE-2024-42348

FOG leaks sensitive information (AD domain, username and password)

HIGH 79

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00587 Published 2024-08-02 Fixed in 1.5.10.41.3 CWE-77

TI-2024-27976 CVE-2024-41954

FOG Weak file permissions

HIGH 67

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00309 Published 2024-07-31 Fixed in 1.5.10.41 CWE-732

TI-2024-27460 CVE-2024-41108

FOG Sensitive Information Disclosure

HIGH 72

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2024-07-31 Fixed in 1.5.10.41 CWE-200

TI-2024-27056 CVE-2024-40645

FOG Authenticated File Upload RCE

HIGH 73

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00964 Published 2024-07-31 Fixed in 1.5.10.41 CWE-434

TI-2024-26809 CVE-2024-39916

NFS server misconfiguration allows file access outside the exported directory

LOW 28

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00285 Published 2024-07-12 Fixed in 1.5.10.30 CWE-453

TI-2024-26807 CVE-2024-39914

FOG has a command injection in /fog/management/export.php?filename=

HIGH 82

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.23237 Published 2024-07-12 Fixed in 1.5.10.34 CWE-77

TI-2024-22807 CVE-2024-34477

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain…

HIGH 69

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure).

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00266 Published 2024-05-27 No fix listed CWE-250

TI-2023-24864 CVE-2023-46237

FOG path traversal via unauthenticated endpoint

LOW 33

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00576 Published 2023-10-31 Fixed in 1.5.10 CWE-22

TI-2023-24863 CVE-2023-46236

FOG SSRF via unauthenticated endpoint(s)

MEDIUM 44

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0056 Published 2023-10-31 Fixed in 1.5.10 CWE-918

TI-2023-24862 CVE-2023-46235

FOG stored XSS on log screen via unsanitized request logging

LOW 27

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00361 Published 2023-10-31 Fixed in 1.5.10.15 CWE-79

TI-2021-12081 CVE-2021-32243 · GHSA-7v34-qmrf-6vq8

FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).

MEDIUM 40

FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01116 Published 2021-06-16 No fix listed CWE-434

Vulnerabilities

Filters