The flaw is a stored cross‑site scripting vulnerability that arises from server‑side input not being sanitized and from the lack of HTML escaping when rendering records on multiple management pages. Data entered by an attacker is persisted in the database and subsequently executed in the browser of any logged‑in user who views the affected page, allowing the attacker to run arbitrary JavaScript. This can result in session hijacking, credential theft, or defacement of the FOG interface.

FOGProject’s fogproject software is affected on all releases before 1.5.10.1812. The vulnerability appears on the Host, Storage, Group, Image, Printer and Snapin management pages, where new or edited records are displayed.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1 % suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access capable of creating or updating records, implying the attack vector is internal or privileged. Once injected, the malicious payload is stored and delivered to any user who visits the affected pages, providing a persistent exploitation vector for those with read‑access.