CVE catalog

CVE-2026-76175

SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an S

[CVE catalog]

Severity
High · CVSS 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianocsinventory-serversid2.8.1+dfsg1+~2.11.1-3vulnerable
Debianocsinventory-serverbookworm2.8.1+dfsg1+~2.11.1-1vulnerable
Ubuntuocsinventory-server16.042.1.2-1vulnerable
Ubuntuocsinventory-server16.042.1.2-1ubuntu1vulnerable
Ubuntuocsinventory-server18.042.2+dfsg-0.1vulnerable
Ubuntuocsinventory-server20.042.5+dfsg1-1vulnerable
Ubuntuocsinventory-server20.042.5+dfsg1-1ubuntu0.1vulnerable
Ubuntuocsinventory-server22.042.8.1+dfsg1-1vulnerable
Ubuntuocsinventory-server22.042.8.1+dfsg1-1ubuntu0.1vulnerable
Ubuntuocsinventory-server24.042.8.1+dfsg1+~2.11.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianocsinventory-serversourcesid(unfixed)not yet assignedNot reported[1146890]
Debianocsinventory-serversourcebookworm(unfixed)not yet assignedNot reported[1146890]

[Debian bug #1146890]

Notes

[bookworm] ocsinventory-server: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ocsinventory-reports]Affected

    Source package: [ocsinventory-server]

    Details (2)

    • 2.8.1+dfsg1+~2.11.1-1 · all · bookworm

      Affected

      nvd · ocsinventory-server · debian · bookworm; nvd · ocsinventory-server · debian · 12

    • 2.8.1+dfsg1+~2.11.1-1 · all · bookworm

      Affected

      nvd · ocsinventory-server · debian · bookworm; nvd · ocsinventory-server · debian · 12

  • [ocsinventory-server]Affected
    Details (2)

    • 2.8.1+dfsg1+~2.11.1-1 · all · bookworm

      Affected

      nvd · ocsinventory-server · debian · bookworm; nvd · ocsinventory-server · debian · 12

    • 2.8.1+dfsg1+~2.11.1-1 · all · bookworm

      Affected

      nvd · ocsinventory-server · debian · bookworm; nvd · ocsinventory-server · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]