EUVD-2026-70369
GHSA-w845-9495-33qx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires operator login (PR:L); no scope change; no availability impact per description and CVSS 4.0 VA:N.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
2DescriptionCVE.org
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.
AnalysisAI
SQL injection in OCSReports (OCS Inventory NG) allows authenticated users holding operator privileges to extract or manipulate the full application database via the unsanitized del_check parameter at the /ocsreports/?function=save_query_list endpoint. The CVSS 4.0 score of 8.6 reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against the underlying database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session with at least operator-level privileges in OCSReports; unauthenticated attackers cannot reach this endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately frames the risk: network accessible, no attack complexity or special attack requirements, but gated by operator-level privilege (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched version has been confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all accounts with operator privileges and confirm they are held by legitimate personnel; check access logs for suspicious query-save endpoint activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ocsreports
View allRemote code execution in OCS Inventory NG's Ocsreports web console (admin_info CSV upload endpoint) allows an authentica
Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/Java
SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to rea
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today