SQL Injection Vulnerability in Omnispace Agora Project

CVE-2026-63165

What is CVE-2026-63165?

The Omnispace Agora Project, prior to version 26.10.0, contains a SQL injection vulnerability within its calendar functionality. An attacker can exploit this flaw by manipulating the 'sortEvents' parameter, which is improperly concatenated into the ORDER BY clause without adequate sanitization. This vulnerability enables malicious actors to execute error-based SQL injection techniques, potentially allowing them to retrieve sensitive information, including database version data, from the affected system.

References