CVE-2026-76178: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in OCS Inventory NG Ocsreports

This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the /ocsreports/?function=notification endpoint of OCS Inventory NG's Ocsreports. Specifically, an administrator can input malicious HTML that is stored and rendered without proper sanitization when other administrators access the notification template customization view. This allows execution of arbitrary JavaScript code within the security context of the application, risking session compromise of other administrative users. The issue is confirmed in version 2.12.6. No official patch or remediation level has been provided as of the publication date.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary JavaScript code in the context of other administrators, potentially leading to session hijacking or other administrative account compromises. This elevates risk within the administrative interface of Ocsreports, impacting confidentiality and integrity of administrative sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider monitoring for suspicious activity related to notification template modifications. Avoid using the notification template customization feature if possible.