CVE-2026-76175
Received Received - Intake

SQL Injection in OCS Inventory

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-76175
EUVD
EUVD-2026-70369

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. An authenticated user with operator privileges can manipulate input that is directly incorporated into an SQL query without proper validation or parameterization. This allows attackers to alter the query structure and extract sensitive database information.

Detection Guidance

To detect this SQL injection vulnerability, monitor web server logs for suspicious requests to the /ocsreports/?function=save_query_list endpoint with unusual parameters like del_check values containing SQL syntax such as quotes or SQL commands. Use tools like SQLmap to test for injection by sending crafted inputs and observing database responses.

Impact Analysis

An attacker with operator privileges could exploit this to read, modify, or delete database contents, potentially accessing sensitive data like user credentials, personal information, or system configurations. This could lead to data breaches, unauthorized access, or service disruption.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to personal or health data. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Immediately apply input validation and parameterized queries to the del_check parameter. Restrict operator privileges to the minimum required. Update the application to use prepared statements for all SQL queries. Consider deploying a web application firewall to filter malicious inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76175. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart