Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Oct 28, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-116778 · Other software · FOGProject · reported by GitHubHigh 8.8
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-54554 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47689 · Other software · FOGProject · reported by GitHubMedium 4.6
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47688 · Other software · FOGProject · reported by GitHubHigh 8.2
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47687 · Other software · FOGProject · reported by GitHubHigh 7.3
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-47685 · Other software · FOGProject · reported by GitHubHigh 7.3
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-33739 · Other software · FOGProject · reported by GitHubMedium 5.7
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing tables on multiple management pages (Host, Storage, Group, Image, Printer, Snapin) are vulnerable to Stored Cross-Site Scripting (XSS), due to insufficient server-side parameter sanitization in record creations/updates and a lack of HTML escaping in listing tables. Version 1.5.10.1812 patches the issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-24138 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2025-58443 · Other software · FOGProject · reported by GitHubCritical 9.9
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-42349 · Other software · FOGProject · reported by GitHubMedium 5.3
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server (fog_login_accepted.log and fog_login_failed.log), exposing the name of the user account used to manage FOG, the IP address of the computer used to login and the User-Agent. This vulnerability is fixed in 1.5.10.47.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-42348 · Other software · FOGProject · reported by GitHubCritical 9.3
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-41954 · Other software · FOGProject · reported by GitHubMedium 5.3
FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2024-41108 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending on that host. Otherwise, an error message containing "Invalid tasking!" will be returned. The domainpassword in the hostinfo dump is hidden even to authenticated users, as it is displayed as a row of asterisks when navigating to the host's Active Directory settings. This vulnerability is fixed in 1.5.10.41.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-40645 · Other software · FOGProject · reported by GitHubHigh 8.8
FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse. This vulnerability is fixed in 1.5.10.41.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2024-39916 · Other software · FOGProject · reported by GitHubMedium 6.4
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-39914 · Other software · FOGProject · reported by GitHubCritical 9.8
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash aCVE-2024-34477 · Other software · fogproject · reported by MITREHigh 7.8
configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vulnerability, someone needs to mount an NFS share in order to add an executable file as root. In addition, the SUID bit must be added to this file.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackvens.frforums.fogproject.org
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46237 · Other software · FOGProject · reported by GitHubMedium 5.8
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46236 · Other software · FOGProject · reported by GitHubHigh 8.6
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2023-46235 · Other software · FOGProject · reported by GitHubMedium 5.4
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).CVE-2021-32243 · Other software · Fogproject · reported by MITREHigh 8.8
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
- Product
- Fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2014Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1)CVE-2014-3111 · Other software · Fogproject · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page, (2) Image Name field to the Image Management page, (3) Storage Group Name field to the Storage Management page, (4) Username field to the User Cleanup FOG Configuration page, or (5) Directory Path field to the Directory Cleaner FOG Configuration page.
- Product
- FOG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfogproject.orgseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.