AP
Product
Agora Project
21
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Severity mix
Critical 1High 13Medium 7Low 0
Watch
Add Agora Project to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63146 | 9.8 | Oct 13 | Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php Affected: before 26.10.0 |
| CVE-2026-63161 | 8.8 | Oct 13 | Omnispace Agora Project < 26.10.0 Session Fixation via Authentication Affected: before 26.10.0 |
| CVE-2026-63162 | 8.8 | Oct 13 | Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter Affected: before 26.10.0 |
| CVE-2026-63154 | 8.8 | Oct 13 | Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] Affected: before 26.10.0 |
| CVE-2026-63174 | 8.1 | Oct 13 | Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList Affected: before 26.10.0 |
| CVE-2026-63153 | 8.1 | Oct 13 | Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() Affected: before 26.10.0 |
| CVE-2026-63165 | 8.1 | Oct 13 | Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter Affected: before 26.10.0 |
| CVE-2026-63152 | 8.1 | Oct 13 | Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter Affected: before 26.10.0 |
| CVE-2026-63163 | 7.5 | Oct 13 | Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload Affected: before 26.10.0 |
| CVE-2026-63160 | 7.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage Affected: before 26.10.0 |
| CVE-2026-63159 | 7.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover Affected: before 26.10.0 |
| CVE-2026-63158 | 7.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies Affected: before 26.10.0 |
| CVE-2026-63149 | 7.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() Affected: before 26.10.0 |
| CVE-2026-63172 | 7.1 | Oct 13 | Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit Affected: before 26.10.0 |
| CVE-2026-63169 | 6.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe Affected: before 26.10.0 |
| CVE-2026-63156 | 6.1 | Oct 13 | Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter Affected: before 26.10.0 |
| CVE-2026-63171 | 5.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Stored XSS via Category Description Affected: before 26.10.0 |
| CVE-2026-63168 | 5.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass Affected: before 26.10.0 |
| CVE-2026-63157 | 5.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Stored XSS via Links Module Affected: before 26.10.0 |
| CVE-2026-63148 | 5.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename Affected: before 26.10.0 |
| CVE-2026-63147 | 5.4 | Oct 13 | Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name Affected: before 26.10.0 |
Showing 21