Dashboard / CVE-2026-22675

CVE-2026-22675

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 50/100
Published: 2026-04-06 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
AT: None
VC: None
VI: None
VA: None

Description

OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
OCS Inventory OCS Inventory NG Server 0

References & Advisories (3)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.22%
Raw Score 0.002220
Percentile 12.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00222
2026-11-12
0.00222
2026-11-10
0.00222
2026-11-09
0.00222
2026-11-08
0.00222

Intelligence Sources

mitre ref →

External Links