CVE-2021-46355
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
OCS Inventory 2.9.1 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this by manipulating the name of a device (e.g., a printer) on the victim's computer, replacing it with malicious code.
Risk Assessment
The risk involves the execution of malicious scripts in the browser of an administrator or other user viewing inventory data, potentially leading to session hijacking, data leakage, or further attacks.
Recommendation
It is recommended to immediately upgrade OCS Inventory to a version newer than 2.9.1 that includes a fix for the XSS vulnerability. Also consider input filtering and sanitization for device names.
Other vulnerabilities in OCS Inventory
See all- CVE-2026-76177High
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services.
- CVE-2026-76176High
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.
- CVE-2026-76175High
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.
Original NVD description (English source)
OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS