Threat database

CVE-2026-63171 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can inject malicious scripts by submitting a specially crafted forum category description containing a double-quote character. This input breaks out of an HTML input value attribute due to the HTMLPurifier configuration preserving double-quotes, allowing script execution in users' browsers who view the affected forum category.

CVE-2026-63169 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can post messages containing attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch. These malicious iframes are stored and rendered to other channel members, enabling zero-click drive-by downloads and execution of framed JavaScript in recipients' browsers.

CVE-2026-63168 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this flaw by submitting malicious script code via two-dimensional POST arrays during the LDAP/person import process. The vulnerability arises because the paramsFilter() function does not properly recurse into nested arrays, allowing unneutralized markup to be persisted in user profiles. This malicious script can then execute in other users' browsers when the profile is viewed.

CVE-2026-63157 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can inject malicious scripts via an unsanitized 'adress' field in the Links module, which is reflected in an onclick event-handler attribute without proper neutralization of quotes. This vulnerability allows execution of arbitrary scripts in the browsers of users viewing the links list, potentially leading to session hijacking or client-side compromise.

Omnispace Agora Project versions before 26.10.0 have a reflected cross-site scripting (XSS) vulnerability in the visioUrl parameter. This flaw allows unauthenticated attackers to inject malicious HTML attributes and execute arbitrary JavaScript in victims' browsers before authentication. The vulnerability arises because the visioUrl parameter bypasses URL sanitization and is urldecoded after filtering. The issue is fixed in version 26.10.0.

CVE-2026-63148 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this by uploading a poll-response attachment with a malicious filename that bypasses input sanitization. The malicious filename is stored and later rendered in user-facing components like the dashboard, enabling script execution in the browsers of users who view the affected page.

CVE-2026-63147 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can upload files with malicious script embedded in the filename, which bypasses filtering mechanisms because filenames are processed via $_FILES instead of $_GET/$_POST. This unsanitized filename is stored and later rendered to other users, enabling script execution in their browsers.

CVE-2026-63172 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows non-administrative users to create new user accounts by bypassing authorization checks in the user-edit action. This flaw can lead to privilege escalation by unauthorized account creation.

Omnispace Agora Project versions before 26.10.0 contain a session fixation vulnerability. This flaw allows remote attackers to hijack authenticated sessions by setting a known session identifier in a victim's browser before login. The application does not regenerate the session ID upon successful authentication, enabling attackers to access the victim's session after login.

CVE-2026-63174 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows a space administrator to assign users to spaces outside their authorized scope due to missing authorization checks in the spaceAffectList affectation process. Specifically, the import flow's join INSERT operation lacks a readRight() verification, enabling attackers to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

CVE-2026-63153 is a high-severity authorization bypass vulnerability in Omnispace Agora Project versions before 26.10.0. It exists in the setAffectations() function, where authenticated users can add access-right records for target spaces without proper verification of their rights. This flaw breaks tenant isolation by allowing attackers to assign access to spaces they do not own or control, leading to unauthorized access to restricted areas.

Omnispace Agora Project versions before 26.10.0 contain a SQL injection vulnerability in the calendar module. The flaw arises from unsanitized user input in the sortEvents parameter, which is directly concatenated into an SQL ORDER BY clause. This allows attackers to perform error-based SQL injection attacks to extract sensitive database information, including version details. The vulnerability has a high severity rating with a CVSS score of 8.6. No official patch or remediation details are provided in the input data.

Omnispace Agora Project versions before 26.10.0 contain a second-order SQL injection vulnerability via the _idCategoryFilter parameter. Authenticated attackers can inject malicious SQL that is stored in the session and later executed when the filter is applied, potentially leading to unauthorized database access or manipulation. The vulnerability has a high severity with a CVSS 4.0 score of 8.6.

CVE-2026-63163 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows unauthenticated attackers to bypass authorization on the MobileFileDownload route by using an md5 hash of the filename as a token. This enables attackers to download arbitrary protected files without proper authorization, resulting in unauthorized information disclosure.

Omnispace Agora Project versions before 26.10.0 have a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by manipulating the tmpFolderName parameter. This can lead to remote code execution if an attacker writes malicious files to the web root or other sensitive locations.

CVE-2026-63154 is a SQL injection vulnerability in Omnispace Agora Project versions before 26.10.0. It allows a space administrator to escalate privileges by injecting malicious SQL column identifiers during the user import process. Attackers can exploit this flaw to set administrative flags and gain general administrator privileges.

Omnispace Agora Project versions before 26.10.0 have a vulnerability where the persistent remember-me token is stored in plaintext on the server. This token is identical to the bearer credential in the user's cookie, allowing attackers who access the stored token to authenticate as the user without a password.

CVE-2026-63159 affects Omnispace Agora Project versions before 26.10.0 and involves a weak password recovery mechanism. The vulnerability arises because the password-reset token is generated deterministically as sha1(login.password), making it predictable and reusable. This allows unauthenticated attackers to compute or brute-force valid reset tokens from known or guessed login and password combinations, enabling account takeover.

Omnispace Agora Project versions before 26.10.0 have an authentication bypass vulnerability. Attackers who obtain a user's stored bcrypt password hash can authenticate as that user without knowing the actual password. This is due to the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the password hash as a bearer token. Exploitation allows impersonation of any user, including administrators, leading to unauthorized access.

CVE-2026-63149 is a critical vulnerability in Omnispace Agora Project versions before 26.10.0. It involves the use of insufficiently random values for generating temporary or default account passwords via PHP's uniqid() function, which is based on server time in microseconds. This predictability allows attackers who can observe or approximate the account creation time to compute the password and potentially take over the account before the legitimate user logs in.