Stored Cross-Site Scripting Vulnerability in OCS Inventory NG by OCS Reports

CVE-2026-76178

What is CVE-2026-76178?

A stored Cross-Site Scripting (XSS) vulnerability exists within the notification template feature of OCS Inventory NG, specifically at the endpoint /ocsreports/?function=notification. This flaw permits administrators with sufficient privileges to input malicious HTML content. Consequently, the unfiltered content is stored and later displayed when other administrators access the template customization view. This behavior enables the execution of arbitrary JavaScript code in the context of the application, raising significant concerns about session integrity and potential unauthorized access to other administrators’ sessions.

References