CVE-2026-63165

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description A SQL injection issue exists in the calendar functionality. An attacker can inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in the app/ModCalendar/CtrlCalendar.php file. This flaw can be exploited using error-based techniques, such as extractvalue payloads, to retrieve database information, including version data, from the system.

Recommendations Update to version 26.10.0 or later. As a temporary mitigation, restrict access to the calendar functionality or avoid using the sortEvents parameter until the update is applied.