Riskcovery

CVE-2026-22675

OCS Inventory NG Server Stored XSS via User-Agent

State
Published
Severity
5.1 Medium
Published
Apr 6, 2026
Updated
Jul 14, 2026
Reserved
Jan 8, 2026

Read the record on cve.org

Description

OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.

Scores

CVSSScoreVectorSource
4.05.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NVulnCheck
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NVulnCheck

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
OCS Inventory NG ServerOCS Inventory
  • 2.12.3 and earlierAffected
  • 78faf2ca8b897141ba4d337d75692ab8e405bd4eNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.