CVE-2026-63168 Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter request...

CVE-2026-63168

The Omnispace Agora Project before version 26.10.0 is susceptible to a stored cross-site scripting (XSS) vulnerability. The root cause is a failure in the paramsFilter() request parameter filter, which does not recurse into nested arrays, allowing authenticated attackers to bypass security checks...