CVE-2026-63157

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description Authenticated users can perform a stored cross-site scripting attack by submitting an unsanitized adress field. This input is echoed into an onclick event-handler attribute without neutralizing quotes, allowing malicious scripts to be stored via the Links module. When other users view the links list, the payload executes in their browser, which can lead to session hijacking or client-side compromise.

Recommendations Update to version 26.10.0 or later. Restrict access to the Links module as a temporary mitigation measure.