Omnispace Agora Project
14 CVEs affecting Omnispace Agora Project. Latest disclosed: 2026-10-13. Critical: 0, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63162 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary di… |
CVE-2026-63161 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a kn… |
CVE-2026-63174 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside the… |
CVE-2026-63165 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by ma… |
CVE-2026-63152 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the… |
CVE-2026-63163 | High | 7.5 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to… |
CVE-2026-63160 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value… |
CVE-2026-63159 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accoun… |
CVE-2026-63172 | High | 7.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts… |
CVE-2026-63169 | Medium | 6.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacke… |
CVE-2026-63156 | Medium | 6.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML a… |
CVE-2026-63171 | Medium | 5.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by s… |
CVE-2026-63168 | Medium | 5.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup… |
CVE-2026-63157 | Medium | 5.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by subm… |