Ocs Inventory Server
Approved changes feed: RSS · Atom
cpe:2.3:a:ocsinventory-ng:ocs_inventory_server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Ocsinventory Ng (dbdc0856-cab8-5e28-9450-b6d900921e8c) |
|---|---|
| Product | Ocs Inventory Server (1436a6ab-4371-555d-a09c-f4e7e5b53fe6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/ocsinventory-server |
purl2cpe | 2026-06-01 10:17:04.428012 |
pkg:deb/ubuntu/ocsinventory-server |
purl2cpe | 2026-06-01 10:17:04.428014 |
pkg:github/ocsinventory-ng/ocsinventory-server |
purl2cpe | 2026-06-01 10:17:04.428016 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-22675 |
vulnerable | 2026-06-08 07:51:13.567571 |
OCS Inventory NG Server Stored XSS via User-Agent
MEDIUM (5.4)
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.
Published: 2026-04-06T21:19:59.435Z
Updated: 2026-07-14T15:53:27.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-14857 |
vulnerable | 2026-06-08 05:10:53.604009 |
Details available
Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file extensions other than .html are permitted.
Published: 2018-08-06T21:00:00.000Z
Updated: 2024-08-05T09:38:14.001Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.