CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
Attackers can extract database information via SQL injection in the calendar sortEvents parameter of Omnispace Agora Project.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63165?
CVE-2026-63165 is a high-severity SQL injection vulnerability in Omnispace Agora Project, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.
Weakness: CWE-89
Which versions are affected by CVE-2026-63165?
How do I fix CVE-2026-63165?
No fix has been published for CVE-2026-63165 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-63165 being exploited?
There is no known exploitation of CVE-2026-63165 in the wild and no public exploit code.
Sources
Also known as GHSA-35vx-ffcf-7cr8.