OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton() in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick handler, using htmlspecialchars(ENT_QUOTES) only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. frontend/views/computer-details.php passes $computer->hostname to this helper using Computer::DEFAULT_COMPUTER_COMMANDS in lib/Models/Computer.class.php, whose VNC, RDP, SSH, and Ping entries…