CVE-2026-63147

MEDIUM5.4

Published 2026-10-13 · Source disclosure@vulncheck.com

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-95696
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
2026-10-13 · score 6.5
CVE-2026-95640
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
2026-10-13 · score 5.5
CVE-2026-94520
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
2026-10-13 · score 4.9
CVE-2026-88089
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
2026-10-13 · score 6.7
CVE-2026-88086
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
2026-10-13 · score 5.3