CVE-2026-76176CWE-89sql-injection

CVE-2026-76176

published September 3, 2026

CVSS
8.6
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-03T17:06Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 09:47Z
    Multiple vulnerabilities in Ocsreports for OCS Inventory NG
    cvelistv5