CVE-2026-63165: falha de alta gravidade em Omnispace Agora Project
Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.3%
probabilidade de exploração
0.3%top 78% das CVEs
exploração observada
nãonenhuma fonte reporta
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Omnispace · Agora ProjectCVEs relacionadas — Omnispace Agora Project
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63162HIGHOmnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName ParameterEPSS 0.7%CVE-2026-63146CRITICALOmnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.phpEPSS 0.7%CVE-2026-63154HIGHOmnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]EPSS 0.4%CVE-2026-63158CRITICALOmnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via CookiesEPSS 0.4%CVE-2026-63161HIGHOmnispace Agora Project < 26.10.0 Session Fixation via AuthenticationEPSS 0.4%CVE-2026-63149CRITICALOmnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()EPSS 0.4%