CVE-2026-63157— Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Quick assessment
Affected
Omnispace Agora Project
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Omnispace Agora Project 26.10.0 版本之前，存在一个存储型跨站脚本（Stored XSS）漏洞。该漏洞允许已认证用户通过提交一个未经过清理的链接地址（adress）字段，将恶意脚本注入系统中。由于该字段值被直接回显到 onclick 事件处理程序的属性中，且未对引号进行转义或过滤，从而导致脚本注入。 攻击者可以通过“Links”模块存储精心构造的恶意负载，当其他用户浏览链接列表时，该脚本将在其浏览器中自动执行，从而可能导致会话劫持或进一步的后端/客户端系统受损。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Omnispace | Agora Project | < 26.10.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Source: CVE Program / CVE List V5
Vulnerability Description
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Omnispace | Agora Project | 0 ~ 26.10.0 | - |
|
II. Public POCs for CVE-2026-63157
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63157
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63157 (1)
Vendor Advisories for CVE-2026-63157 (1)
Vendor Pages for CVE-2026-63157 (1)
Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total
| CVE-2026-63146 | 9.8 CRITICAL | Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php |
| CVE-2026-63161 | 8.8 HIGH | Omnispace Agora Project < 26.10.0 Session Fixation via Authentication |
| CVE-2026-63162 | 8.8 HIGH | Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter |
| CVE-2026-63154 | 8.8 HIGH | Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] |
| CVE-2026-63153 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() |
| CVE-2026-63174 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList |
| CVE-2026-63165 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter |
| CVE-2026-63152 | 8.1 HIGH | Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter |
| CVE-2026-63163 | 7.5 HIGH | Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload |
| CVE-2026-63149 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() |
| CVE-2026-63158 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies |
| CVE-2026-63159 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover |
| CVE-2026-63160 | 7.4 HIGH | Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage |
| CVE-2026-63172 | 7.1 HIGH | Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit |
| CVE-2026-63169 | 6.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe |
| CVE-2026-63156 | 6.1 MEDIUM | Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter |
| CVE-2026-63147 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name |
| CVE-2026-63148 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename |
| CVE-2026-63168 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass |
| CVE-2026-63171 | 5.4 MEDIUM | Omnispace Agora Project < 26.10.0 Stored XSS via Category Description |
IV. Related Vulnerabilities
Same product: Agora Project
-
CVE-2026-63171
Omnispace Agora Project < 26.10.0 Stored XSS via Category De -
CVE-2026-63169
Omnispace Agora Project < 26.10.0 Stored XSS via Messenger I -
CVE-2026-63168
Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST -
CVE-2026-63156
Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl -
CVE-2026-63148
Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Respon
Same vendor: Omnispace
-
CVE-2026-63171
Omnispace Agora Project < 26.10.0 Stored XSS via Category De -
CVE-2026-63169
Omnispace Agora Project < 26.10.0 Stored XSS via Messenger I -
CVE-2026-63168
Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST -
CVE-2026-63156
Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl -
CVE-2026-63148
Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Respon
Same weakness: CWE-79
-
CVE-2026-104726
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stor -
CVE-2026-109224
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Script -
CVE-2026-93681
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-96870
SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-100106
FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cr
V. Comments for CVE-2026-63157
No comments yet