Skip to content
OpenAdvisories

Vendor

FOGProject

19 known vulnerabilities.

Products

fogproject 19
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-47689

    FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` …

    FOGProject fogproject
  • Medium 5.7
    CVE-2026-33739

    FOG has Stored XSS in Multiple Management Pages

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing tables on multiple management pages (Host, Storage, Group, Image, Printer, Snapin) are vulnerable to Stored Cross-Site Scripting (XSS), due t…

    FOGProject fogproject
  • Medium 5.3
    CVE-2024-42349

    FOG has a Log Information Disclosure

    FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server (fog_…

    FOGProject fogproject
  • Medium 5.3
    CVE-2024-41954

    FOG Weak file permissions

    FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a …

    FOGProject fogproject
  • Medium 6.4
    CVE-2024-39916

    NFS server misconfiguration allows file access outside the exported directory

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default insta…

    FOGProject fogproject
  • Medium 5.8
    CVE-2023-46237

    FOG path traversal via unauthenticated endpoint

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticat…

    FOGProject fogproject
  • Medium 5.4
    CVE-2023-46235

    FOG stored XSS on log screen via unsanitized request logging

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the F…

    FOGProject fogproject