CVE-2026-76175
CVE-2026-76175 · Multiple vulnerabilities in Ocsreports for OCS Inventory NG
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.
CVSS 8.6 · High · EPSS 0.3%
- Published
- Updated
Stack: system
Affected products and versions
ocsreports
- Versions
- 2.12.6: Affected
No fix published
ocsinventory-server Debian:12
- Versions
- 2.8.1+dfsg1+~2.11.1-1
- 2.8.1+dfsg1+~2.11.1-2
- 2.8.1+dfsg1+~2.11.1-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ocsinventory-server Ubuntu:16.04:LTS
- Versions
- 2.1.2-1
- 2.1.2-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ocsinventory-server Ubuntu:18.04:LTS
- Versions
- 2.2+dfsg-0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ocsinventory-server Ubuntu:20.04:LTS
- Versions
- 2.5+dfsg1-1
- 2.5+dfsg1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ocsinventory-server Ubuntu:22.04:LTS
- Versions
- 2.8.1+dfsg1-1
- 2.8.1+dfsg1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ocsinventory-server Ubuntu:24.04:LTS
- Versions
- 2.8.1+dfsg1+~2.11.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published