HIGHCVSS 8.6

CVE-2026-76176

CVE-2026-76176 updated by NVD

Published: 2026-09-03
Modified: 2026-09-05
Sources: euvd, nvd

Summary

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-76176

Includes data from the ENISA EU Vulnerability Database (EUVD).

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.