OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitation and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.
References
| Link | Resource |
|---|---|
| https://github.com/OCSInventory-NG/OCSInventory-Server/commit/78faf2ca8b897141ba4d337d75692ab8e405bd4e | Patch |
| https://github.com/OCSInventory-NG/OCSInventory-Server/pull/483 | Issue Tracking |
| https://www.vulncheck.com/advisories/ocs-inventory-ng-server-stored-xss-via-user-agent | Third Party Advisory VDB Entry |
Configurations
History
09 Apr 2026, 17:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ocsinventory-ng
Ocsinventory-ng ocs Inventory Server |
|
| CPE | cpe:2.3:a:ocsinventory-ng:ocs_inventory_server:*:*:*:*:*:*:*:* | |
| References | () https://github.com/OCSInventory-NG/OCSInventory-Server/commit/78faf2ca8b897141ba4d337d75692ab8e405bd4e - Patch | |
| References | () https://github.com/OCSInventory-NG/OCSInventory-Server/pull/483 - Issue Tracking | |
| References | () https://www.vulncheck.com/advisories/ocs-inventory-ng-server-stored-xss-via-user-agent - Third Party Advisory, VDB Entry |
06 Apr 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-06 22:16
Updated : 2026-04-09 17:37
NVD link : CVE-2026-22675
Mitre link : CVE-2026-22675
CVE.ORG link : CVE-2026-22675
JSON object : View
Products Affected
ocsinventory-ng
- ocs_inventory_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')