CVE-2026-63165
8.1HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-89
Impact
Authenticated attackers can execute arbitrary SQL queries to exfiltrate and modify database contents. They only need low-privilege network access to the calendar feature.
Root cause
The sortEvents parameter is concatenated directly into an ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php.
Affected systems
Omnispace Agora Project before 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later. If upgrading must wait, restrict access to the application or disable the calendar module.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.