FFOGProject

Products

Exploited and recent CVEs

• CVE-2026-116778 High 8.8 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution 0.5%
• CVE-2026-54554 High 7.5 FOG adInfo endpoint is reported to disclose the Active Directory join password 0.6%
• CVE-2026-47689 Medium 4.6 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab 0.3%
• CVE-2026-47688 High 8.2 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules 0.3%
• CVE-2026-47687 High 7.3 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint 0.4%
• CVE-2026-47685 High 7.3 FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page 0.4%
• CVE-2026-33739 Medium 5.7 FOG has Stored XSS in Multiple Management Pages 0.2%
• CVE-2026-24138 High 7.5 FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php` 0.4%
• CVE-2025-58443 Critical 9.9 FOG's authentication bypass leads to full SQL DB dump 21.3%
• CVE-2024-42349 Medium 5.3 FOG has a Log Information Disclosure 0.6%
• CVE-2024-42348 Critical 9.3 FOG leaks sensitive information (AD domain, username and password) 0.6%
• CVE-2024-41954 Medium 5.3 FOG Weak file permissions 0.3%
• CVE-2024-41108 High 7.5 FOG Sensitive Information Disclosure 0.6%
• CVE-2024-40645 High 8.8 FOG Authenticated File Upload RCE 1.0%
• CVE-2024-39916 Medium 6.4 NFS server misconfiguration allows file access outside the exported directory 0.3%
• CVE-2024-39914 Critical 9.8 FOG has a command injection in /fog/management/export.php?filename= 23.2%
• CVE-2023-46237 Medium 5.8 FOG path traversal via unauthenticated endpoint 0.6%
• CVE-2023-46236 High 8.6 FOG SSRF via unauthenticated endpoint(s) 0.6%
• CVE-2023-46235 Medium 5.4 FOG stored XSS on log screen via unsanitized request logging 0.4%