CVE-2026-63168

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description Authenticated attackers can persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow. This occurs because the paramsFilter() function fails to recurse into nested arrays, allowing the request parameter filter to be bypassed. Consequently, arbitrary script code can be injected into a user profile and executed in the browsers of other users who view that profile. Stored cross-site scripting is a flaw where malicious scripts are permanently stored on the target server.

Recommendations Update to version 26.10.0 or later.