# CVE-2026-76175: OCS Inventory Ocsreports SQL injection in del_check parameter

Source: https://junglewise.ai/threats/cve-2026-76175-ocs-inventory-ocsreports-sql-injection-in-del-check-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76175 · Severity: info · CVSS 8.6 · Published 2026-09-03

OCS Inventory Ocsreports is an open-source IT asset and inventory management system. A SQL injection vulnerability in the query list management endpoint allows authenticated operators to manipulate database queries and extract sensitive information, including configuration data, user credentials, or asset inventory details.

## Quick answers

**Is CVE-2026-76175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76175 being exploited in the wild.

**How severe is CVE-2026-76175?** Informational severity, with a CVSS score of 8.6, published 3 September 2026.

**Which products and versions are affected?** OCS Inventory Ocsreports before 2.12.6.

**Is there a fix for CVE-2026-76175?** A patch was published on 2026-09-03: Fixed in version 2.12.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76175 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76175?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-76175 is a SQL injection vulnerability (CWE-89) in the /ocsreports/?function=save_query_list endpoint, specifically in the del_check parameter. The vulnerability exists because user-supplied input from authenticated operators is directly incorporated into SQL queries without parameterization or validation. An attacker with operator-level privileges can craft malicious SQL payloads in the del_check parameter to manipulate queries and extract arbitrary data from the database. The vulnerability requires authentication and operator-level permissions but no user interaction; it is network-reachable. A fix is available in version 2.12.6.

## Affected products

- OCS Inventory Ocsreports before 2.12.6

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 2.12.6

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng)