Skip to content
Noroxi

FOGProject records

19 published records for vendor fogproject.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
36.8%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 23
  3. 24
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

19 records
  • CVE-2024-39914
    46Plan

    FOG has a command injection in /fog/management/export.php?filename=

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    fogproject · fogprojectJul 12, 2024

  • CVE-2025-58443
    45Plan

    FOG's authentication bypass leads to full SQL DB dump

    CriticalCVSS 9.9Proof of conceptEPSS 19%

    fogproject · fogprojectSep 6, 2025

  • CVE-2021-32243
    35Monitor

    FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).

    HighCVSS 8.8No exploitEPSS 1%

    fogproject · fogprojectJun 16, 2021

  • CVE-2024-40645
    35Monitor

    FOG Authenticated File Upload RCE

    HighCVSS 8.8No exploitEPSS 1%

    fogproject · fogprojectJul 31, 2024

  • CVE-2024-42348
    34Monitor

    FOG leaks sensitive information (AD domain, username and password)

    HighCVSS 8.6No exploitEPSS 1%

    fogproject · fogprojectAug 2, 2024

  • CVE-2026-47687
    34Monitor

    FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

    HighCVSS 8.7No exploitEPSS 0%

    fogproject · fogprojectJul 21, 2026

  • CVE-2026-47685
    34Monitor

    FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

    HighCVSS 8.7No exploitEPSS 0%

    fogproject · fogprojectJul 21, 2026

  • CVE-2026-47688
    32Monitor

    FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

    HighCVSS 8.2No exploitEPSS 0%

    fogproject · fogprojectJul 21, 2026

  • CVE-2024-41954
    31Monitor

    FOG Weak file permissions

    HighCVSS 7.8No exploitEPSS 0%

    fogproject · fogprojectJul 31, 2024

  • CVE-2024-34477
    31Monitor

    configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because

    HighCVSS 7.8No exploitEPSS 0%

    fogproject · fogprojectMay 27, 2024

  • CVE-2023-46236
    30Monitor

    FOG SSRF via unauthenticated endpoint(s)

    HighCVSS 7.5No exploitEPSS 0%

    fogproject · fogprojectOct 31, 2023

  • CVE-2024-39916
    25Monitor

    NFS server misconfiguration allows file access outside the exported directory

    MediumCVSS 6.4No exploitEPSS 0%

    fogproject · fogprojectJul 12, 2024

  • CVE-2023-46235
    24Monitor

    FOG stored XSS on log screen via unsanitized request logging

    MediumCVSS 6.1No exploitEPSS 0%

    fogproject · fogprojectOct 31, 2023

  • CVE-2024-41108
    23Monitor

    FOG Sensitive Information Disclosure

    MediumCVSS 5.9No exploitEPSS 1%

    fogproject · fogprojectJul 31, 2024

  • CVE-2024-42349
    21Monitor

    FOG has a Log Information Disclosure

    MediumCVSS 5.3No exploitEPSS 1%

    fogproject · fogprojectAug 2, 2024

  • CVE-2023-46237
    21Monitor

    FOG path traversal via unauthenticated endpoint

    MediumCVSS 5.3No exploitEPSS 0%

    fogproject · fogprojectOct 31, 2023

  • CVE-2026-47689
    20Monitor

    FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

    MediumCVSS 5.2No exploitEPSS 0%

    fogproject · fogprojectJul 21, 2026

  • CVE-2026-33739
    19Monitor

    FOG has Stored XSS in Multiple Management Pages

    MediumCVSS 4.8No exploitEPSS 0%

    fogproject · fogprojectMar 27, 2026

  • CVE-2014-3111
    14Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script

    LowCVSS 3.5No exploitEPSS 1%

    fogproject · fogOct 21, 2014