The vulnerability is a stored cross‑site scripting flaw in FOGProject. Earlier releases of the system render option labels in the selectForm() helper with raw, unescaped input. An unauthenticated attacker who knows a host’s MAC address can submit a malicious sysproduct value to /service/inventory.php. This value is persisted in the database and, when an administrator opens the Inventory reports, the payload is injected into an <option> element, breaking out of the tag and executing arbitrary JavaScript in the admin’s browser. This can lead to theft of session cookies or other actions that compromise the integrity and confidentiality of the system.

FOGProject fogproject is affected in all releases earlier than 1.5.10.1832 and 1.6.0-beta.2313. Those versions include the faulty selectForm() behavior that stores unescaped option labels.

The CVSS score of 7.3 indicates a high severity flaw, while an EPSS score of less than 1% and the absence from the CISA KEV catalog suggest the likelihood of exploitation is relatively low. The attack requires an unauthenticated attacker to know a host’s MAC address and POST a malicious sysproduct value to /service/inventory.php, where it is stored. When an administrator subsequently opens the Inventory reports, the payload is rendered and the script runs. The vector is a standard HTTP POST to an unauthenticated endpoint, with the effect limited to admin‑level browsers that view inventory reports.