Stored XSS Vulnerability in OCO-Server Management Application
CVE-2026-61791

7.4HIGH

Key Information:

Vendor

Schorschii

Status
Oco-server
Vendor
CVE Published:
22 October 2026

What is CVE-2026-61791?

A stored XSS vulnerability exists in the OCO-Server management application, where the commandButton() function in lib/Html.class.php allows crafted hostnames to inject malicious JavaScript code into an administrator's session. This occurs when an affected command button is activated, allowing attackers to abuse administrator privileges without needing custom command configurations. The issue stems from improper escaping of data passed to JavaScript context. Version 1.2.1 mitigates this risk by implementing necessary security measures.

Affected Version(s)

OCO-Server < 1.2.1

References

https://github.com/schorschii/OCO-Server/security/advisor...
x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/ef02f9768...
x_refsource_MISC
https://github.com/schorschii/OCO-Server/releases/tag/v1.2.1
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.