CVE-2026-47689

Name of the Vulnerable Software and Affected Versions FOG versions prior to 1.5.10.1832 FOG versions prior to 1.6.0-beta.2313

Description The buildRow() function in fogpage.class.php fails to perform HTML escaping when substituting data values into HTML table cell templates via str replace(). An unauthenticated attacker with knowledge of a registered host's MAC address can send malicious inventory values, such as sysproduct or sysserial, to the '/service/inventory.php' endpoint. These values are stored in the database and subsequently executed as HTML or JavaScript in the administrator's browser when the Group Inventory tab is accessed.

Recommendations Update to version 1.5.10.1832. Update to version 1.6.0-beta.2313.