CVE-2026-63166

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only...

CVE-2026-63166

Omnispace Agora Project versions through 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in VuePersonsImportExport.php , where values from imported directory data or uploaded CSV files are rendered into table cell text and value attributes using only T...

CVE-2026-63166 Omnispace Agora Project 26.10.0 Stored XSS via CSV Import Preview

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only...