CVE-2026-63148— Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
Quick assessment
Affected
Omnispace Agora Project
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Omnispace Agora 项目 26.10.0 版本之前，存在一个存储型跨站脚本（Stored Cross-Site Scripting, XSS）漏洞。该漏洞允许已认证的攻击者通过上传包含恶意文件名的投票响应附件，绕过针对 $_FILES 参数所应用 paramFilter 清理机制，从而注入 HTML/脚本标记。攻击者可提交精心构造的文件名，该文件名会被存储，并在后续由仪表板控制器（CtrlDashboard）等组件进行渲染时，导致在查看受影响页面的用户浏览器中执行任意脚本。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Omnispace | Agora Project | < 26.10.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63148
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
Source: CVE Program / CVE List V5
Vulnerability Description
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Omnispace | Agora Project | 0 ~ 26.10.0 | - |
|
II. Public POCs for CVE-2026-63148
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63148
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63148 (1)
Vendor Pages for CVE-2026-63148 (1)
Other References for CVE-2026-63148 (1)
Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total
| CVE-2026-63146 | 9.8 CRITICAL | Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php |
| CVE-2026-63161 | 8.8 HIGH | Omnispace Agora Project < 26.10.0 Session Fixation via Authentication |
| CVE-2026-63162 | 8.8 HIGH | Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter |
| CVE-2026-63154 | 8.8 HIGH | Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] |
| CVE-2026-63153 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() |
| CVE-2026-63174 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList |
| CVE-2026-63165 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter |
| CVE-2026-63152 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter |
| CVE-2026-63163 | 7.5 HIGH | Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload |
| CVE-2026-63149 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() |
| CVE-2026-63158 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies |
| CVE-2026-63159 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover |
| CVE-2026-63160 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage |
| CVE-2026-63172 | 7.1 HIGH | Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit |
| CVE-2026-63169 | 6.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe |
| CVE-2026-63156 | 6.1 MEDIUM | Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter |
| CVE-2026-63147 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name |
| CVE-2026-63168 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass |
| CVE-2026-63171 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Category Description |
| CVE-2026-63157 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Links Module |
IV. Related Vulnerabilities
Same product: Agora Project
-
CVE-2026-63171
Omnispace Agora Project < 26.10.0 Stored XSS via Category De -
CVE-2026-63169
Omnispace Agora Project < 26.10.0 Stored XSS via Messenger I -
CVE-2026-63168
Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST -
CVE-2026-63157
Omnispace Agora Project < 26.10.0 Stored XSS via Links Modul -
CVE-2026-63156
Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl
Same vendor: Omnispace
-
CVE-2026-63171
Omnispace Agora Project < 26.10.0 Stored XSS via Category De -
CVE-2026-63169
Omnispace Agora Project < 26.10.0 Stored XSS via Messenger I -
CVE-2026-63168
Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST -
CVE-2026-63157
Omnispace Agora Project < 26.10.0 Stored XSS via Links Modul -
CVE-2026-63156
Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl
Same weakness: CWE-79
-
CVE-2026-109685
WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scr -
CVE-2026-105882
WordPress User Registration plugin <= 5.2.8 - Cross Site Scr -
CVE-2026-109702
WordPress Social Share Buttons plugin <= 1.31 - Cross Site S -
CVE-2026-108491
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripti -
CVE-2026-108498
WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scrip
V. Comments for CVE-2026-63148
No comments yet