Threats tagged 'ghsa-283j-wrq8-qxwj'

Omnispace Agora Project versions through 26.10.0 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious HTML markup via imported directory data or uploaded CSV files. The vulnerability arises because input values are only UTF-8 encoded without proper HTML escaping, enabling crafted CSV cells to execute arbitrary scripts in the administrator's browser during import.