OCSInventory-NG/OCSInventory-Server

OCSInventory-NG/OCSInventory-Server

www.ocsinventory-ng.org

Releases14

Frequency4 months 4 weeks

Last Release over 5 years ago

Stars397

Communication server of OCS Inventory

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-22675 ↗	Apr 6, 2026Monday, 6 April 2026, 22:16	5.4 MEDIUM	—
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.