CVE-2026-76175: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in OCS Inventory NG Ocsreports

This vulnerability arises from the del_check parameter in the /ocsreports/?function=save_query_list endpoint of OCS Inventory NG Ocsreports version 2.12.6. The input from an authenticated operator user is incorporated into an SQL query without proper parameterization or validation, enabling SQL injection attacks. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

An attacker with operator-level authentication privileges can exploit this vulnerability to manipulate SQL queries, potentially extracting sensitive information from the database. This compromises the confidentiality and integrity of the affected system's data. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict operator-level access to trusted users only and monitor for suspicious activity related to the vulnerable endpoint.