CVE-2026-63157

Deferred Deferred - Pending Action

Stored XSS in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63157

EUVD

EUVD-2026-100475

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project before version 26.10.0. Authenticated users can inject malicious scripts via an unsanitized link address field. The injected payload is stored and executed when other users view the links list, as the field is echoed into an onclick event-handler without proper quote neutralization.

Detection Guidance

To detect this stored XSS vulnerability in Omnispace Agora Project before 26.10.0, inspect the Links module for unsanitized link addresses. Check if the 'adress' field is echoed into onclick event-handler attributes without quote neutralization. Manually review stored links for suspicious payloads or use browser developer tools to inspect rendered HTML for malicious scripts.

Impact Analysis

Attackers can hijack user sessions or perform further client-side attacks by executing arbitrary scripts in the browser of any user viewing the compromised links. This could lead to unauthorized data access, account takeover, or malware delivery.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to user data or session hijacking. Organizations using the affected software could face compliance violations, fines, or reputational damage due to insufficient input sanitization and lack of proper security controls.

Mitigation Strategies

Immediately upgrade Omnispace Agora Project to version 26.10.0 or later to patch the stored XSS flaw. If upgrading is not possible, disable the Links module or restrict user permissions to prevent unauthorized link submissions. Implement input validation to sanitize the 'adress' field and escape quotes in onclick event handlers.

Hi! I’m here to help you understand CVE-2026-63157. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70