OCS Inventory NG is an asset and inventory-management platform deployed across enterprise environments to track hardware, software, and network infrastructure. Despite a narrow product portfolio centered on the core inventory server, agent, and reporting components, the vendor appears in a more prominent position than typical for its size, reflecting the breadth of systems that depend on its asset-visibility role. The vulnerabilities affecting this vendor span a dispersed set of weakness classes without a single dominant pattern, characteristic of a mature application handling input from diverse client environments and administrative interfaces. Defenders should maintain awareness of this vendor's update cycle as part of broader infrastructure-management hygiene; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ocsinventory Ng over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-1443HIGH Multiple unspecified vulnerabilities in the Server component in OCS Inventory NG before 1.02 have unknown impact and attack vectors. | Apr 27, 2009 | 10.0 | 36 | NO | YES |
CVE-2009-3042HIGH SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attackers to execute arbitrary SQL commands via the systemid parame | Sep 1, 2009 | 7.5 | 32 | NO | YES |
CVE-2009-3040HIGH Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL | Sep 1, 2009 | 7.5 | 30 | NO | YES |
CVE-2018-15537HIGH Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests. | Nov 29, 2018 | 8.8 | 29 | NO | NO |
CVE-2018-14857HIGH Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged us | Aug 6, 2018 | 8.8 | 29 | NO | NO |
CVE-2018-14473CRITICAL OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in or | Aug 4, 2018 | 9.1 | 29 | NO | NO |
CVE-2011-4024MEDIUM Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vector | Oct 21, 2011 | 4.3 | 29 | NO | YES |
CVE-2018-12483HIGH OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GET parameter is concat | Aug 4, 2018 | 8.8 | 28 | NO | NO |
CVE-2018-12482HIGH OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues. | Aug 4, 2018 | 8.8 | 27 | NO | NO |
CVE-2026-22675MEDIUM OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submit | Apr 6, 2026 | 6.1 | 25 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ocsinventory Ng.
Media articles that mention a CVE ID that affects a product developed by Ocsinventory Ng — matched by CVE ID, not by vendor name.