Threat Intelligence Database

CVE-2026-63171 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can inject malicious scripts by submitting a specially crafted forum category description containing a double-quote character. This input breaks out of an HTML input value attribute due to the HTMLPurifier configuration preserving double-quotes, enabling script execution in the browsers of users viewing the affected forum category.

Omnispace Agora Project versions before 26.10.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can post messages with attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch. These malicious iframes are stored and rendered automatically to other channel members, potentially enabling zero-click drive-by downloads and execution of framed JavaScript in recipients' browsers.

CVE-2026-63168 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can submit malicious script code via two-dimensional POST arrays in the LDAP/person import flow, bypassing the paramsFilter() which does not recurse into nested arrays. This allows injection of arbitrary scripts into user profiles that execute in other users' browsers.

CVE-2026-63157 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can inject malicious scripts via an unsanitized 'adress' field in the Links module, which is reflected in an onclick event-handler attribute without proper neutralization. This allows execution of arbitrary scripts in the browsers of users viewing the links list, potentially leading to session hijacking or client-side compromise.

CVE-2026-63156 is a reflected cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. It allows unauthenticated attackers to inject malicious HTML attributes via the visioUrl parameter, which was improperly sanitized and urldecoded after filtering. This flaw enables execution of arbitrary JavaScript in the victim's browser before authentication. The issue was fixed in version 26.10.0 by modifying the request handling code.

CVE-2026-63148 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this by uploading a poll-response attachment with a malicious filename that bypasses input sanitization. This crafted filename is stored and later rendered in the dashboard controller, leading to arbitrary script execution in users' browsers who view the affected page.

CVE-2026-63147 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can exploit this by uploading files with malicious HTML or script code embedded in the filename. The vulnerability arises because the filename is not properly sanitized and bypasses filtering mechanisms, leading to script execution in other users' browsers when the filename is rendered.

CVE-2026-63172 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows non-administrative users to create unauthorized user accounts by bypassing function-level authorization checks in the user-edit action. This flaw can lead to privilege escalation by enabling attackers to gain elevated access.

CVE-2026-63161 is a session fixation vulnerability in Omnispace Agora Project versions before 26.10.0. It allows remote attackers to hijack authenticated sessions by setting a known session identifier in a victim's browser before login. The application fails to regenerate the session ID upon successful authentication, enabling attackers to gain unauthorized access to the victim's session after login.

CVE-2026-63174 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows a space administrator to assign users to spaces outside their authorized scope due to missing authorization checks during the user-space assignment process. Specifically, the vulnerability arises because the spaceAffectList affectation does not verify the caller's rights to the target space, enabling attackers to bypass tenant isolation.