Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Agora Project — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in Agora Project, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities affecting the Agora Project, categorized by Common Weakness Enumeration (CWE) types and associated tags. It aggregates data from official vendor advisories, security mailing lists, and third-party tracking sources to provide a comprehensive view of the threat landscape surrounding this specific software product. The content covers publicly disclosed security issues from the project’s inception through the present day, ensuring that both legacy and current exposure risks are accounted for in the historical record. Here, security professionals and developers can track the evolution of a vendor’s security advisories over time, gaining insight into how the organization responds to emerging threats. Users can also delve into specific weakness classes to understand the root causes of defects within the Agora Project’s codebase, facilitating deeper analysis of systemic issues rather than isolated incidents. Additionally, this resource allows for a detailed look up of a product's vulnerability history, enabling teams to assess long-term stability and maintenance practices. By consolidating fragmented data into a single reference point, this page supports more effective risk management and remediation planning. It serves as a neutral, factual archive intended for technical analysis and compliance verification rather than promotional material or speculative commentary. The goal is to provide transparency into the security posture of Agora Project through verifiable data points and structured categorization of known weaknesses.

Vendor: Omnispace

CVE ID Title CVSS Severity Published
CVE-2026-63171 Omnispace Agora Project < 26.10.0 Stored XSS via Category Description CWE-79 5.4 Medium 2026-10-13
CVE-2026-63169 Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe CWE-79 6.4 Medium 2026-10-13
CVE-2026-63168 Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass CWE-79 5.4 Medium 2026-10-13
CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module CWE-79 5.4 Medium 2026-10-13
CVE-2026-63156 Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter CWE-79 6.1 Medium 2026-10-13
CVE-2026-63148 Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename CWE-79 5.4 Medium 2026-10-13
CVE-2026-63147 Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name CWE-79 5.4 Medium 2026-10-13
CVE-2026-63172 Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit CWE-862 7.1 High 2026-10-13
CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication CWE-384 8.8 High 2026-10-13
CVE-2026-63174 Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList CWE-862 8.1 High 2026-10-13
CVE-2026-63153 Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() CWE-639 8.1 High 2026-10-13
CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter CWE-89 8.1 High 2026-10-13
CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter CWE-89 8.1 High 2026-10-13
CVE-2026-63163 Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload CWE-639 7.5 High 2026-10-13
CVE-2026-63162 Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter CWE-22 8.8 High 2026-10-13
CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] CWE-89 8.8 High 2026-10-13
CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage CWE-522 7.4 High 2026-10-13
CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover CWE-640 7.4 High 2026-10-13
CVE-2026-63158 Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies CWE-836 7.4 High 2026-10-13
CVE-2026-63149 Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() CWE-330 7.4 High 2026-10-13
CVE-2026-63146 Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php CWE-94 9.8 Critical 2026-10-13

All 21 known CVE vulnerabilities affecting Agora Project with full Chinese analysis, references, and POCs where available.