Stored Cross-Site Scripting in OCS Inventory NG Server by OCS Inventory

CVE-2026-22675

What is CVE-2026-22675?

The OCS Inventory NG Server, specifically version 2.12.3 and earlier, is susceptible to a stored cross-site scripting vulnerability. This issue allows unauthenticated attackers to exploit the /ocsinventory endpoint by injecting malicious User-Agent HTTP headers. When these headers are processed, they can lead to the execution of arbitrary JavaScript within the browsers of authenticated users viewing the affected web console, significantly compromising user security. The lack of proper input sanitization and encoding enables attackers to craft rogue requests that are stored and subsequently rendered in the statistics dashboard.

References