CVE-2026-63148

MEDIUM5.4

Published 2026-10-13 · Source disclosure@vulncheck.com

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-95696
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
2026-10-13 · score 6.5
CVE-2026-95640
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
2026-10-13 · score 5.5
CVE-2026-94520
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
2026-10-13 · score 4.9
CVE-2026-88089
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
2026-10-13 · score 6.7
CVE-2026-88086
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
2026-10-13 · score 5.3