PT-2026-30738 · Unknown · Ocsinventory-Server

Charleneauger · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-22675

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OCS Inventory NG Server versions 2.12.3 and prior

Description OCS Inventory NG Server versions 2.12.3 and prior contain a stored cross-site scripting issue. Unauthenticated attackers can execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory API endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values. These values are stored without proper sanitation and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.

Recommendations Update OCS Inventory NG Server to a version later than 2.12.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22675

Affected Products

Ocsinventory-Server

References · 10

• https://github.com/OCSInventory-NG/OCSInventory-Server/commit/78faf2ca8b897141ba4d337d75692ab8e405bd4e · Patch
• https://cve.org/CVERecord?id=CVE-2026-22675 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22675 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22675 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-22675 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22675 · Vendor Advisory
• https://github.com/OCSInventory-NG/OCSInventory-Server/pull/483 · Note
• https://twitter.com/CVEnew/status/2041282882354991440 · Twitter Post
• https://vulncheck.com/advisories/ocs-inventory-ng-server-stored-xss-via-user-agent · Note