FOG is a free open‑source cloning, imaging, and inventory management system. In versions prior to 1.5.10.1832 and 1.6.0‑beta.2313 the buildRow() function replaces inventory data into HTML table cells using str_replace without any HTML escaping. An unauthenticated attacker who knows a registered host’s MAC address can POST malicious inventory values, such as sysproduct or sysserial, to /service/inventory.php. These values are stored in the database and are later rendered when an administrator opens the Group Inventory tab. The stored payload is then interpreted as executable HTML or JavaScript in the admin’s browser, allowing arbitrary code execution within the browser context.

All installations of FOGProject before version 1.5.10.1832 or 1.6.0‑beta.2313 are affected. The issue is fixed in those releases, so any older installation (including earlier 1.5.x and 1.6.x BETA builds) is at risk.

The CVSS score of 4.6 indicates a moderate impact. The EPSS score is below 1 %, suggesting that exploitation remains unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires knowledge of a host’s MAC address and the ability to POST inventory data to a publicly reachable endpoint, making the attack surface relatively narrow.