CVE-2026-47687

Katalog CVE

CVSS 8.7 · High EPSS 0,41%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada fogproject. Skor CVSS 3.1 8.7 (High) menurut NVD.

Deskripsi (NVD)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2 exploit · advisory vendor