CVEvulnerability
CVE-2026-63148
5.1 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-10-13
- Last modified
- 2026-10-15
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/xech/agora-project/releases/tag/26.10 github.com
- https://www.agora-project.net/ www.agora-project.net
- https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-poll-response-attachment-filename www.vulncheck.com