OCS Inventory NG vulnerabilities
We track 5 vulnerabilities in OCS Inventory NG products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
Latest OCS Inventory NG vulnerabilities
- 9.2 Critical severity
Ocsreports: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed wi
- 7.1 High severity
Ocsreports: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for thes
- 8.6 High severity
Ocsreports: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these
- 8.6 High severity
Ocsreports: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allo
- 9.4 Critical severity
Ocsreports: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting