Advisories · Technology
Omnispace Agora Project.
Every CVE that names Omnispace Agora Project among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
- Omnispace Agora Project
- Cross-site scripting (XSS)
- CVSS 7.1 High
Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
- Omnispace Agora Project
- Broken access control
- CVSS 8.6 High
Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
- Omnispace Agora Project
- Authentication bypass
- CVSS 8.6 High
Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
- Omnispace Agora Project
- Broken access control
- CVSS 8.6 High
Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
- Omnispace Agora Project
- Broken access control
- CVSS 8.6 High
Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
- Omnispace Agora Project
- SQL injection
- CVSS 8.6 High
Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
- Omnispace Agora Project
- SQL injection
- CVSS 8.7 High
Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
- Omnispace Agora Project
- Broken access control
- CVSS 8.7 High
Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
- Omnispace Agora Project
- Path traversal
- CVSS 8.7 High
Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
- Omnispace Agora Project
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
- Omnispace Agora Project
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
- Omnispace Agora Project
- CWE-640
- CVSS 9.1 CriticalCritical · CVSS 9+
Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
- Omnispace Agora Project
- CWE-836
- CVSS 9.1 CriticalCritical · CVSS 9+
Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
- Omnispace Agora Project
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
- Omnispace Agora Project
- Code injection