CVE-2026-63148

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $FILES. Attackers ca...

CVE-2026-63148

The Omnispace Agora Project (versions before 26.10.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated attackers can bypass the paramFilter sanitization applied to ** extsubscript{$_FILES}** by uploading a poll-response attachment with a malicious filename. This crafted f...