What’s Vulnerable › Products
Omnispace Agora Project vulnerabilities
21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.
Check whether your Omnispace Agora Project version is affected
Latest Omnispace Agora Project vulnerabilities
- CVE-2026-63171 — Omnispace Agora Project < 26.10.0 Stored XSS via Category Description (CVSS 5.4)
- CVE-2026-63169 — Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe (CVSS 6.4)
- CVE-2026-63168 — Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass (CVSS 5.4)
- CVE-2026-63157 — Omnispace Agora Project < 26.10.0 Stored XSS via Links Module (CVSS 5.4)
- CVE-2026-63156 — Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter (CVSS 6.1)
- CVE-2026-63174 — Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList (CVSS 8.1)
- CVE-2026-63172 — Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit (CVSS 7.1)
- CVE-2026-63165 — Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter (CVSS 8.1)
- CVE-2026-63163 — Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload (CVSS 7.5)
- CVE-2026-63162 — Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter (CVSS 8.8)
- CVE-2026-63161 — Omnispace Agora Project < 26.10.0 Session Fixation via Authentication (CVSS 8.8)
- CVE-2026-63160 — Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage (CVSS 7.4)
- CVE-2026-63159 — Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover (CVSS 7.4)
- CVE-2026-63158 — Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies (CVSS 7.4)
- CVE-2026-63154 — Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] (CVSS 8.8)
- CVE-2026-63153 — Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() (CVSS 8.1)
- CVE-2026-63152 — Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter (CVSS 8.1)
- CVE-2026-63149 — Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() (CVSS 7.4)
- CVE-2026-63148 — Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename (CVSS 5.4)
- CVE-2026-63147 — Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name (CVSS 5.4)
- CVE-2026-63146 — Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php (CVSS 9.8)