Fogproject Fog vulnerabilities

• fogproject FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution CVE-2026-116778 8.8 HighOctober 28, 2026
• fogproject FOG adInfo endpoint is reported to disclose the Active Directory join password CVE-2026-54554 7.5 HighOctober 14, 2026
• fogproject FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab CVE-2026-47689 4.6 MediumJuly 21, 2026
• fogproject FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules CVE-2026-47688 8.2 HighJuly 21, 2026
• fogproject FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint CVE-2026-47687 7.3 HighJuly 21, 2026
• fogproject FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page CVE-2026-47685 7.3 HighJuly 21, 2026
• fogproject FOG has Stored XSS in Multiple Management Pages CVE-2026-33739 5.7 MediumMarch 27, 2026
• fogproject FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php` CVE-2026-24138 7.5 HighJanuary 23, 2026
• fogproject FOG's authentication bypass leads to full SQL DB dump CVE-2025-58443 Public exploit EPSS 21.3% 9.9 CriticalSeptember 6, 2025
• fogproject FOG has a Log Information Disclosure CVE-2024-42349 5.3 MediumAugust 2, 2024
• fogproject FOG leaks sensitive information (AD domain, username and password) CVE-2024-42348 9.3 CriticalAugust 2, 2024
• fogproject FOG Weak file permissions CVE-2024-41954 5.3 MediumJuly 31, 2024
• fogproject FOG Sensitive Information Disclosure CVE-2024-41108 7.5 HighJuly 31, 2024
• fogproject FOG Authenticated File Upload RCE CVE-2024-40645 8.8 HighJuly 31, 2024
• fogproject NFS server misconfiguration allows file access outside the exported directory CVE-2024-39916 6.4 MediumJuly 12, 2024
• fogproject FOG has a command injection in /fog/management/export.php?filename= CVE-2024-39914 Public exploit EPSS 23.2% 9.8 CriticalJuly 12, 2024
• fogproject configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vu… CVE-2024-34477 7.8 HighMay 27, 2024
• fogproject FOG path traversal via unauthenticated endpoint CVE-2023-46237 5.8 MediumOctober 31, 2023
• fogproject FOG SSRF via unauthenticated endpoint(s) CVE-2023-46236 8.6 HighOctober 31, 2023
• fogproject FOG stored XSS on log screen via unsanitized request logging CVE-2023-46235 5.4 MediumOctober 31, 2023
• fogproject FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated). CVE-2021-32243 8.8 HighJune 16, 2021
• fogproject fog Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote... CVE-2014-3111 3.5 LowOctober 21, 2014