CVE-2026-76174— Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Quick assessment
Affected
OCS Inventory NG Ocsreports
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ocsreports 管理接口 中的 CSV 文件上传功能存在未限制的文件上传漏洞。应用程序仅根据客户端提供的文件名进行验证，而未正确检查文件内容或安全地限制允许的文件类型。这使得具有管理员权限的用户能够将 PHP 文件上传到可通过 Web 界面访问的目录。如果该文件随后被服务器处理，攻击者即可执行任意代码，其权限等同于 Web 服务账户所具有的权限。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OCS Inventory NG | Ocsreports | 2.12.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76174
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Source: CVE Program / CVE List V5
Vulnerability Description
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows a user with administrator privileges to upload PHP files to a directory accessible via the web interface. If the file is subsequently processed by the server, an attacker could execute arbitrary code with the privileges of the account used by the web service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OCS Inventory NG | Ocsreports | 2.12.6 | - |
|
II. Public POCs for CVE-2026-76174
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76174
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76174 (1)
Same Patch Batch · OCS Inventory NG · 2026-09-03 · 5 CVEs total
| CVE-2026-76178 | 9.2 CRITICAL | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
| CVE-2026-76176 | 8.6 HIGH | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
| CVE-2026-76175 | 8.6 HIGH | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
| CVE-2026-76177 | 7.1 HIGH | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
IV. Related Vulnerabilities
Same product: Ocsreports
Same vendor: OCS Inventory NG
Same weakness: CWE-434
-
CVE-2026-85208
itsourcecode Online Medicine Delivery System Order Managemen -
CVE-2026-85186
itsourcecode Online Medicine Delivery System Customer Contro -
CVE-2026-85135
ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObj -
CVE-2026-82524
UnoPim File Upload RCE via TinyMCE Image Upload Endpoint -
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Uplo
V. Comments for CVE-2026-76174
No comments yet