Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 37

Export CSV
CVE-2026-63166

Omnispace Agora Project 26.10.0 Stored XSS via CSV Import Preview

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63150

Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63167

Omnispace Agora Project 26.10.0 SQL Injection via personsSort Session Value

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.

CVSS 4.0 · 8.5 High EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63173

Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()

Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63151

Omnispace Agora Project 26.10.0 Predictable Token Information Disclosure via DisplayIcal

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63164

Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63170

Omnispace Agora Project 26.10.0 Predictable Share Token via md5Id

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63174

Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63172

Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63171

Omnispace Agora Project < 26.10.0 Stored XSS via Category Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63169

Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63168

Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63165

Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63163

Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63162

Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63161

Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63160

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63159

Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63158

Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project
CVE-2026-63157

Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Agora-project Omnispace
Products
Agora-project Agora Project