Skip to content
OpenAdvisories

Product · schorschii

OCO-Server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-61791

    OCO-Server: Stored XSS through agent hostnames in command buttons

    OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname i…

    schorschii OCO-Server