CVE-2026-63156
CVE-2026-63156 · Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.
CVSS 5.1 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
agora project
- Versions du logiciel
- ≥ 0, < 26.10.0: Concernée (semver)
Mettez à jour vers 26.10.0