PatchFirst · Latest vulnerabilities

ocsinventory-server vulnerabilities

Vulnerabilities published for ocsinventory-server in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 5

CVE-2026-22675
Medium · CVSS 5.1EPSS 0.22%No fix published
OCS Inventory NG Server Stored XSS via User-Agent
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.
ocsinventory-server Operating systems
Published April 6, 2026Updated July 14, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2023-3726
Medium · CVSS 6.9EPSS 0.63%No fix published
OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
ocsinventory-server Operating systems
Published January 4, 2024Updated September 24, 2025
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-14947
High · CVSS 8.8EPSS 19.48%Public exploitNo fix published
CVE-2020-14947
OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
ocsinventory-server Operating systems
Published June 30, 2020Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-15537
High · CVSS 8.8EPSS 5.02%No fix published
CVE-2018-15537
Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests.
ocsinventory-server Operating systems
Published November 29, 2018Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2014-4722
Not ratedEPSS 2.35%No fix published
CVE-2014-4722
Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
ocsinventory-server Operating systems
Published July 7, 2014Updated August 6, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

ocsinventory-server vulnerabilities

OCS Inventory NG Server Stored XSS via User-Agent

OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting

CVE-2020-14947

CVE-2018-15537

CVE-2014-4722

Check your server