Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

fogproject — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in fogproject, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting the Fog Project open-source disk imaging and deployment system. The collection encompasses a wide spectrum of issues ranging from privilege escalation and remote code execution to cross-site scripting and information disclosure vulnerabilities discovered between the software's initial release and the present day. Visitors can utilize this resource to track official vendor advisories regarding the Fog Project, analyze the prevalence and characteristics of specific weakness classes within network imaging tools, or review the complete historical vulnerability record for this product to assess its security posture. The data presented here serves as a centralized reference for security researchers, system administrators, and auditors seeking to understand the risk landscape associated with deploying Fog Project in enterprise or educational environments. By consolidating disparate reports into a single view, this index facilitates efficient threat analysis and helps organizations prioritize remediation efforts based on the severity and age of identified flaws. Users should consult the detailed entries for specific mitigation strategies and patch availability information provided by the maintainers. This compilation aims to support proactive security management without endorsing any particular version or configuration of the software.

Vendor: FOGProject

CVE ID Title CVSS Severity Published
CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password CWE-200 7.5 High 2026-10-14
CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab CWE-79 4.6 Medium 2026-07-21
CVE-2026-47688 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules CWE-862 8.2 High 2026-07-21
CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint CWE-79 7.3 High 2026-07-21
CVE-2026-47685 FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page CWE-79 7.3 High 2026-07-21
CVE-2026-33739 FOG has Stored XSS in Multiple Management Pages CWE-79 5.7 Medium 2026-03-27
CVE-2026-24138 FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php` CWE-918 7.5 High 2026-01-23
CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump CWE-306 9.8AI Critical AI 2025-09-06
CVE-2024-42349 FOG has a Log Information Disclosure CWE-532 5.3 Medium 2024-08-02
CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password) CWE-77 9.3 Critical 2024-08-02
CVE-2024-41954 FOG Weak file permissions CWE-732 5.3 Medium 2024-07-31
CVE-2024-41108 FOG Sensitive Information Disclosure CWE-200 7.5 High 2024-07-31
CVE-2024-40645 FOG Authenticated File Upload RCE CWE-434 8.8 High 2024-07-31
CVE-2024-39916 NFS server misconfiguration allows file access outside the exported directory CWE-453 6.4 Medium 2024-07-12
CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename= CWE-77 9.8 Critical 2024-07-12
CVE-2023-46237 FOG path traversal via unauthenticated endpoint CWE-22 5.8 Medium 2023-10-31
CVE-2023-46236 FOG SSRF via unauthenticated endpoint(s) CWE-918 8.6 High 2023-10-31
CVE-2023-46235 FOG stored XSS on log screen via unsanitized request logging CWE-79 5.4 Medium 2023-10-31

All 18 known CVE vulnerabilities affecting fogproject with full Chinese analysis, references, and POCs where available.