CVE-2026-63157

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...