CVE-2026-76176: Ocs Inventory NG Ocsreports

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

Affected products

Published 2026-09-03. Last modified 2026-09-03.