UBUNTU-CVE-2026-76175

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-76175

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-76175.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-76175

Upstream

CVE-2026-76175

Published

2026-09-04T00:00:00Z

Modified

2026-09-05T06:16:06.967531502Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequery_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

References

Affected packages

Ubuntu:16.04:LTS / ocsinventory-server

Package

Name: ocsinventory-server
Purl: pkg:deb/ubuntu/ocsinventory-server?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.2-1

2.1.2-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.1.2-1ubuntu1",
            "binary_name": "ocsinventory-reports"
        },
        {
            "binary_version": "2.1.2-1ubuntu1",
            "binary_name": "ocsinventory-server"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-76175.json"

Ubuntu:18.04:LTS / ocsinventory-server

Package

Name: ocsinventory-server
Purl: pkg:deb/ubuntu/ocsinventory-server?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2+dfsg-0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.2+dfsg-0.1",
            "binary_name": "ocsinventory-reports"
        },
        {
            "binary_version": "2.2+dfsg-0.1",
            "binary_name": "ocsinventory-server"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-76175.json"

Ubuntu:20.04:LTS / ocsinventory-server

Package

Name: ocsinventory-server
Purl: pkg:deb/ubuntu/ocsinventory-server?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.5+dfsg1-1

2.5+dfsg1-1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.5+dfsg1-1ubuntu0.1",
            "binary_name": "ocsinventory-reports"
        },
        {
            "binary_version": "2.5+dfsg1-1ubuntu0.1",
            "binary_name": "ocsinventory-server"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-76175.json"

Ubuntu:22.04:LTS / ocsinventory-server

Package

Name: ocsinventory-server
Purl: pkg:deb/ubuntu/ocsinventory-server?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.1+dfsg1-1

2.8.1+dfsg1-1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.8.1+dfsg1-1ubuntu0.1",
            "binary_name": "ocsinventory-reports"
        },
        {
            "binary_version": "2.8.1+dfsg1-1ubuntu0.1",
            "binary_name": "ocsinventory-server"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-76175.json"

Ubuntu:24.04:LTS / ocsinventory-server

Package

Name: ocsinventory-server
Purl: pkg:deb/ubuntu/ocsinventory-server?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.1+dfsg1+~2.11.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.8.1+dfsg1+~2.11.1-1",
            "binary_name": "ocsinventory-reports"
        },
        {
            "binary_version": "2.8.1+dfsg1+~2.11.1-1",
            "binary_name": "ocsinventory-server"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-76175.json"