CVE-2026-63165
High
Description
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.
SeverityHigh
CVSS8.1
Exploit probability—
ProductAgora Project
PublishedOct 13, 2026
First seenOct 13, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- Omnispace Agora Project26.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Omnispace Agora Project | v < 26.10.0 | 26.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.