CVE-2026-63171
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submittin…
Published Oct 13, 2026 · updated Oct 15, 2026
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute co
Oct 14, 2026 · NIST NVD
Updated
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute co
Oct 15, 2026 · NIST NVD
Updated
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute co
Sources
- CVE.orgVulnerability recordCVE-2026-63171
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-63171
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-63171
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value
nvd.nist.gov