Vulnerability · Published Sep 3, 2026 · Assigned by INCIBE

CVE-2026-76175Multiple vulnerabilities in Ocsreports for OCS Inventory NG

High 8.6

In plain English

A high-severity SQL injection in Ocsreports from OCS Inventory NG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ocsinventory-server	no fix listed	DEBIAN-CVE-2026-76175
Ubuntu:22.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76175
Ubuntu:24.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76175

Affected products (as reported)

Vendor	Product	Versions
OCS Inventory NG	Ocsreports	2.12.6

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng