NI vulnerabilities and threats

Omnispace Agora Project versions before 26.10.0 have a reflected cross-site scripting (XSS) vulnerability in the visioUrl parameter. This flaw allows unauthenticated attackers to inject malicious HTML attributes and execute arbitrary JavaScript in victims' browsers before authentication. The vulnerability arises because the visioUrl parameter bypasses URL sanitization and is urldecoded after filtering. The issue is fixed in version 26.10.0.

CVE-2026-63148 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this by uploading a poll-response attachment with a malicious filename that bypasses input sanitization. The malicious filename is stored and later rendered in user-facing components like the dashboard, enabling script execution in the browsers of users who view the affected page.

CVE-2026-63147 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can upload files with malicious script embedded in the filename, which bypasses filtering mechanisms because filenames are processed via $_FILES instead of $_GET/$_POST. This unsanitized filename is stored and later rendered to other users, enabling script execution in their browsers.

CVE-2026-63172 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows non-administrative users to create new user accounts by bypassing authorization checks in the user-edit action. This flaw can lead to privilege escalation by unauthorized account creation.

Omnispace Agora Project versions before 26.10.0 contain a session fixation vulnerability. This flaw allows remote attackers to hijack authenticated sessions by setting a known session identifier in a victim's browser before login. The application does not regenerate the session ID upon successful authentication, enabling attackers to access the victim's session after login.

CVE-2026-63174 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows a space administrator to assign users to spaces outside their authorized scope due to missing authorization checks in the spaceAffectList affectation process. Specifically, the import flow's join INSERT operation lacks a readRight() verification, enabling attackers to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

CVE-2026-63153 is a high-severity authorization bypass vulnerability in Omnispace Agora Project versions before 26.10.0. It exists in the setAffectations() function, where authenticated users can add access-right records for target spaces without proper verification of their rights. This flaw breaks tenant isolation by allowing attackers to assign access to spaces they do not own or control, leading to unauthorized access to restricted areas.

Omnispace Agora Project versions before 26.10.0 contain a SQL injection vulnerability in the calendar module. The flaw arises from unsanitized user input in the sortEvents parameter, which is directly concatenated into an SQL ORDER BY clause. This allows attackers to perform error-based SQL injection attacks to extract sensitive database information, including version details. The vulnerability has a high severity rating with a CVSS score of 8.6. No official patch or remediation details are provided in the input data.

Omnispace Agora Project versions before 26.10.0 contain a second-order SQL injection vulnerability via the _idCategoryFilter parameter. Authenticated attackers can inject malicious SQL that is stored in the session and later executed when the filter is applied, potentially leading to unauthorized database access or manipulation. The vulnerability has a high severity with a CVSS 4.0 score of 8.6.

CVE-2026-63163 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows unauthenticated attackers to bypass authorization on the MobileFileDownload route by using an md5 hash of the filename as a token. This enables attackers to download arbitrary protected files without proper authorization, resulting in unauthorized information disclosure.

Omnispace Agora Project versions before 26.10.0 have a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by manipulating the tmpFolderName parameter. This can lead to remote code execution if an attacker writes malicious files to the web root or other sensitive locations.

CVE-2026-63154 is a SQL injection vulnerability in Omnispace Agora Project versions before 26.10.0. It allows a space administrator to escalate privileges by injecting malicious SQL column identifiers during the user import process. Attackers can exploit this flaw to set administrative flags and gain general administrator privileges.

Omnispace Agora Project versions before 26.10.0 have a vulnerability where the persistent remember-me token is stored in plaintext on the server. This token is identical to the bearer credential in the user's cookie, allowing attackers who access the stored token to authenticate as the user without a password.

CVE-2026-63159 affects Omnispace Agora Project versions before 26.10.0 and involves a weak password recovery mechanism. The vulnerability arises because the password-reset token is generated deterministically as sha1(login.password), making it predictable and reusable. This allows unauthenticated attackers to compute or brute-force valid reset tokens from known or guessed login and password combinations, enabling account takeover.

Omnispace Agora Project versions before 26.10.0 have an authentication bypass vulnerability. Attackers who obtain a user's stored bcrypt password hash can authenticate as that user without knowing the actual password. This is due to the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the password hash as a bearer token. Exploitation allows impersonation of any user, including administrators, leading to unauthorized access.

CVE-2026-63149 is a critical vulnerability in Omnispace Agora Project versions before 26.10.0. It involves the use of insufficiently random values for generating temporary or default account passwords via PHP's uniqid() function, which is based on server time in microseconds. This predictability allows attackers who can observe or approximate the account creation time to compute the password and potentially take over the account before the legitimate user logs in.

CVE-2026-63146 is a critical code injection vulnerability in Omnispace Agora Project versions before 26.10.0. It involves unescaped attacker-controlled input being written into the config.inc.php file during installation, combined with an SQL injection vulnerability that allows re-triggering the installer. This enables unauthenticated remote code execution on the underlying system.

Swann Communications SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack authentication. This flaw allows an attacker on the local network to access real-time video streams without any authentication. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a medium severity with a CVSS score of 6.9. No official patch or remediation has been provided in the available data.

Swann Communications SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack authentication. This flaw allows an attacker on the local network to retrieve a live feed snapshot without needing to authenticate. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a CVSS 4.0 score of 6.9, indicating medium severity.

SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack proper authentication. This flaw allows an attacker on the local network to access the live video feed without needing to authenticate. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and has a medium severity rating with a CVSS 4.0 score of 5.9.