Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61791— OCO-Server: Stored XSS through agent hostnames in command buttons

Quick assessment

Affected
schorschii OCO-Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OCO-Server 是一款用于计算机资产清单管理、软件部署及移动设备管理的自托管端点管理应用。在 1.2.1 版本之前， 中的 函数会将包含已存储计算机主机名的操作 URL 嵌入到内联 处理程序的 JavaScript 字符串中，且仅使用 进行 HTML 转义。由于浏览器在将处理程序解释为 JavaScript 之前会先对 HTML 实体进行解码，因此攻击者可构造恶意主机名，使其突破字符串边界，并在管理员激活受影响的命令按钮时，于管理员已认证的会话中执行恶意脚本。 通过 中的 将 传递给该辅助函数；其中 VNC、

CVSS 7.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61791

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OCO-Server: Stored XSS through agent hostnames in command buttons
Source: CVE Program / CVE List V5
Vulnerability Description
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面属性中脚本转义处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
schorschii OCO-Server < 1.2.1 -

II. Public POCs for CVE-2026-61791

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61791

请登录查看更多情报信息。

Other References for CVE-2026-61791 (3)

Same Patch Batch · schorschii · 2026-10-22 · 3 CVEs total

CVE-2026-114611 9.1 CRITICAL OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY):
CVE-2026-114515 6.5 MEDIUM OCO-Server: Self-Service Portal uninstall-job authorization bypass

IV. Related Vulnerabilities

Same product: OCO-Server
Same vendor: schorschii
Same weakness: CWE-83

V. Comments for CVE-2026-61791

No comments yet

Leave a comment