Threats tagged 'ghsa-p4qp-qp77-4vr9'

Omnispace Agora Project versions before 26.10.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can exploit this by uploading files with malicious script embedded in the filename. The vulnerability arises because the filename is not properly sanitized, bypassing filters that only inspect $_GET/$_POST parameters. This allows script execution in the browsers of other users when the filename is rendered.