CVE-2026-63171

Deferred Deferred - Pending Action

Stored XSS in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63171

EUVD

EUVD-2026-100479

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project before version 26.10.0. An authenticated attacker can inject malicious scripts by submitting a crafted forum category description containing a double-quote character. This breaks out of an HTML input value attribute, allowing arbitrary script execution in the browsers of users viewing the forum category.

Impact Analysis

If you are a user of the affected Omnispace Agora Project, an attacker could exploit this to execute malicious scripts in your browser when viewing forum categories. This could lead to session hijacking, theft of sensitive data, or unauthorized actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using the vulnerable software may face compliance violations and legal consequences.

Mitigation Strategies

Update Omnispace Agora Project to version 26.10.0 or later to address the stored cross-site scripting vulnerability in forum category descriptions.

Hi! I’m here to help you understand CVE-2026-63171. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70