Vulnerabilities

TI-2026-82015 CVE-2026-116778

Missing authorization in FOG API enables root command execution

MEDIUM 40

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00467 Published 2026-10-28 Fixed in 1.5.10.2253 CWE-78

TI-2026-74374 CVE-2026-54554

Active Directory join password exposed by FOG adInfo endpoint

HIGH 72

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00583 Published 2026-10-14 Fixed in 1.5.10.1870 CWE-200

TI-2026-35193 CVE-2026-47689

FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

LOW 23

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.2 Adjacent network No auth User interaction EPSS 0.00266 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-79

TI-2026-35192 CVE-2026-47688

Missing authorization in fogproject

HIGH 75

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00267 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-862

TI-2026-35191 CVE-2026-47687

FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

HIGH 73

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00406 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-79

TI-2026-35189 CVE-2026-47685

FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

MEDIUM 40

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00372 Published 2026-07-21 Fixed in 1.5.10.1832, 1.6.0-beta.2313 CWE-79

TI-2026-26118 CVE-2026-33739

FOG has Stored XSS in Multiple Management Pages

MEDIUM 59

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.7 Network High privileges User interaction EPSS 0.0019 Published 2026-03-27 Fixed in 1.5.10.1812 CWE-79

TI-2026-19456 CVE-2026-24138

FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`

HIGH 66

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2026-01-23 No fix listed CWE-918

TI-2025-36201 CVE-2025-58443

FOG's authentication bypass leads to full SQL DB dump

HIGH 82

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.21291 Published 2025-09-06 No fix listed CWE-287

TI-2024-28336 CVE-2024-42349

FOG has a Log Information Disclosure

MEDIUM 63

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00568 Published 2024-08-02 Fixed in 1.5.10.47 CWE-532

TI-2024-28335 CVE-2024-42348

FOG leaks sensitive information (AD domain, username and password)

HIGH 79

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00587 Published 2024-08-02 Fixed in 1.5.10.41.3 CWE-77

TI-2024-27976 CVE-2024-41954

FOG Weak file permissions

HIGH 67

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00309 Published 2024-07-31 Fixed in 1.5.10.41 CWE-732

TI-2024-27460 CVE-2024-41108

FOG Sensitive Information Disclosure

HIGH 72

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2024-07-31 Fixed in 1.5.10.41 CWE-200

TI-2024-27056 CVE-2024-40645

FOG Authenticated File Upload RCE

HIGH 73

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00964 Published 2024-07-31 Fixed in 1.5.10.41 CWE-434

TI-2024-26809 CVE-2024-39916

NFS server misconfiguration allows file access outside the exported directory

LOW 28

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00285 Published 2024-07-12 Fixed in 1.5.10.30 CWE-453

TI-2024-26807 CVE-2024-39914

FOG has a command injection in /fog/management/export.php?filename=

HIGH 82

FOG is a cloning/imaging/rescue suite/inventory management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.23237 Published 2024-07-12 Fixed in 1.5.10.34 CWE-77

TI-2024-22807 CVE-2024-34477

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain…

HIGH 69

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure).

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00266 Published 2024-05-27 No fix listed CWE-250

TI-2023-24864 CVE-2023-46237

FOG path traversal via unauthenticated endpoint

LOW 33

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00576 Published 2023-10-31 Fixed in 1.5.10 CWE-22

TI-2023-24863 CVE-2023-46236

FOG SSRF via unauthenticated endpoint(s)

MEDIUM 44

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0056 Published 2023-10-31 Fixed in 1.5.10 CWE-918

TI-2023-24862 CVE-2023-46235

FOG stored XSS on log screen via unsanitized request logging

LOW 27

FOG is a free open-source cloning/imaging/rescue suite/inventory management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00361 Published 2023-10-31 Fixed in 1.5.10.15 CWE-79

TI-2021-12081 CVE-2021-32243 · GHSA-7v34-qmrf-6vq8

FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).

MEDIUM 40

FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01116 Published 2021-06-16 No fix listed CWE-434

TI-2014-02486 CVE-2014-3111 · GHSA-9rcf-cw39-wcmj

Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote…

LOW 19

Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page, (2) Ima…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.00978 Published 2014-10-21 No fix listed CWE-79

Vulnerabilities

Filters