Skip to content
OpenAdvisories

Vendor

FOGProject

19 known vulnerabilities.

Products

fogproject 19
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.8
    CVE-2026-116778

    FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/stora…

    FOGProject fogproject
  • High 7.5
    CVE-2026-54554

    FOG adInfo endpoint is reported to disclose the Active Directory join password

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSO…

    FOGProject fogproject
  • High 8.2
    CVE-2026-47688

    FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET r…

    FOGProject fogproject
  • High 7.3
    CVE-2026-47687

    FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticat…

    FOGProject fogproject
  • High 7.3
    CVE-2026-47685

    FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitizati…

    FOGProject fogproject
  • High 7.5
    CVE-2026-24138

    FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be u…

    FOGProject fogproject
  • High 7.5
    CVE-2024-41108

    FOG Sensitive Information Disclosure

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if…

    FOGProject fogproject
  • High 8.8
    CVE-2024-40645

    FOG Authenticated File Upload RCE

    FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requir…

    FOGProject fogproject
  • High 8.6
    CVE-2023-46236

    FOG SSRF via unauthenticated endpoint(s)

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and…

    FOGProject fogproject