Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63156— Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter

Quick assessment

Affected
Omnispace Agora Project
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Omnispace Agora Project 在版本 26.10.0 之前存在一个反射型跨站脚本（XSS）漏洞。该漏洞允许未认证的攻击者通过操纵 参数注入恶意的 HTML 属性。由于该参数未被路由到参数过滤器的 URL 净化分支，且在过滤之后又进行了 URL 解码，导致安全机制被绕过。 攻击者可以构造一个包含特定 参数的恶意 URL，其中嵌入属性逃逸（attribute breakout）载荷，从而在未认证状态下受害者的浏览器中执行任意 JavaScript 代码。该问题已在版本 26.10.0 中通过修改 文件

CVSS 6.1 · Medium EPSS 0.30% · P21

Affected Version Matrix 1

VendorProduct Version RangeStatus
Omnispace Agora Project < 26.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63156

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Omnispace Agora Project 0 ~ 26.10.0 -

II. Public POCs for CVE-2026-63156

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63156

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63156 (1)

Vendor Advisories for CVE-2026-63156 (1)

Vendor Pages for CVE-2026-63156 (1)

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

CVE-2026-63146 9.8 CRITICAL Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
CVE-2026-63161 8.8 HIGH Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
CVE-2026-63162 8.8 HIGH Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
CVE-2026-63154 8.8 HIGH Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
CVE-2026-63153 8.1 HIGH Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
CVE-2026-63174 8.1 HIGH Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
CVE-2026-63165 8.1 HIGH Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
CVE-2026-63152 8.1 HIGH Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
CVE-2026-63163 7.5 HIGH Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
CVE-2026-63149 7.4 HIGH Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
CVE-2026-63158 7.4 HIGH Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
CVE-2026-63159 7.4 HIGH Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
CVE-2026-63160 7.4 HIGH Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
CVE-2026-63172 7.1 HIGH Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
CVE-2026-63169 6.4 MEDIUM Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe
CVE-2026-63147 5.4 MEDIUM Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
CVE-2026-63148 5.4 MEDIUM Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
CVE-2026-63168 5.4 MEDIUM Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
CVE-2026-63171 5.4 MEDIUM Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
CVE-2026-63157 5.4 MEDIUM Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

IV. Related Vulnerabilities

Same product: Agora Project
Same vendor: Omnispace
Same weakness: CWE-79

V. Comments for CVE-2026-63156

No comments yet

Leave a comment