CVE-2026-22675

OCS Inventory NG Server versions 2.12.3 and earlier contain a stored cross-site scripting vulnerability in the /ocsinventory endpoint that permits unauthenticated attackers to inject malicious JavaScript through crafted User-Agent HTTP headers. The vulnerability arises from insufficient input sanitation and output encoding, allowing attackers to register rogue agents or manipulate requests whose payloads persist in the system and execute in the browsers of authenticated users accessing the statistics dashboard. The vulnerability carries a CVSS 3.1 score of 5.4 (Medium), with a network-based attack vector requiring low complexity and low privileges, though user interaction is necessary. The attack scope is changed, and the potential impact is limited to low confidentiality and integrity compromise with no availability impact. The EPSS score of 0.00041 indicates exceptionally low probability of exploitation in the wild relative to other known vulnerabilities. There is no evidence of active exploitation in the wild, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. The Hot List status is inactive, and community attention appears minimal. No publicly available exploit code has been identified, and the low EPSS score suggests this remains a low-priority threat despite the broader accessibility of unauthenticated attack vectors.