CVE-2026-63148
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploadi…
Published Oct 13, 2026 · updated Oct 14, 2026
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard cont
Oct 14, 2026 · NIST NVD
Updated
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard cont
Sources
- CVE.orgCVE-2026-63148
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-63148
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2026-63148
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_F
nvd.nist.gov