SQL Injection Vulnerability in OCS Inventory NG by OCS Inventory

CVE-2026-76175

What is CVE-2026-76175?

A significant SQL injection vulnerability exists in the del_check parameter of the /ocsreports/?function=save_query_list endpoint in OCS Inventory NG. This flaw allows authenticated users with operator privileges to craft input that, due to a lack of proper parameterization and validation, is directly incorporated into SQL queries. Consequently, this facilitates the manipulation of the query, enabling attackers to extract sensitive information from the database using SQL injection methods. Organizations using affected versions of OCS Inventory NG should urgently assess their installations to mitigate the risks associated with this vulnerability. For further details, refer to the advisory from INCIBE.

References