Threats tagged 'ghsa-qgfm-25pr-4ww7'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.3	CVE-2026-63169Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated Medium5.32026-10-13GCVE DatabaseCVE-2026-63169 Omnispace Agora Project versions before 26.10.0 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can post messages containing attacker-controlled iframes that bypass HTMLPurifier's SafeIframe filtering. These malicious iframes are stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and execution of framed JavaScript in recipients' browsers. Report on CVE-2026-63169 Vulnerability CWE-79 #ghsa-qgfm-25pr-4ww7	GCVE Database	2026-10-13

Page 1 of 1