OCO-Server vulnerabilities

2 known vulnerabilities in OCO-Server from Schorschii. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  OCO-Server: Improper Certificate Validation

  CVE-2026-114611Oct 22, 2026Schorschii

  OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `op

• 7.4 High severity

  OCO-Server: Improper Neutralization of Script in Attributes in a Web Page

  CVE-2026-61791Oct 22, 2026Schorschii

  OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname in