Omnispace Agora Project: SQL injection via sortEvents parameter in calendar
Summary
Omnispace Agora Project before 26.10.0 contains an SQL injection flaw in the calendar module. The sortEvents parameter is concatenated into an ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. An attacker with a low-privilege account and network access can use error-based techniques, such as extractvalue payloads, to extract database information including version data.
Affected
- Omnispace Agora Project versions 0 to before 26.10.0 (per CVE record)
Fixed in
- Version 26.10.0 (per CVE record and vendor release tag 26.10)
- An unverified third-party source names 26.10.1; check the current release on the GitHub releases page
Workaround
Unknown.
Exploitation
- Error-based SQL injection via the sortEvents parameter; the advisory describes extractvalue payloads that reveal database version data
- Requires network access and a low-privilege account (PR:L), no user interaction
- CISA SSVC: exploitation none, not automatable, total technical impact
- A PoC entry exists in third-party aggregators; not verified here
- No evidence of exploitation in the wild found; Unknown.
Our recommendation
- Upgrade Agora Project to the latest release (at least 26.10.0)
- Until patched, restrict calendar access to trusted users and check whether the instance is reachable from the internet
- Run the application's database account with minimal privileges
- Review web server logs for unusual values in the calendar sorting parameter
- Check the advisory and release notes for further fixes in the same release
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release 26.10 (xech/agora-project) github.com
- VulnCheck advisory: SQL Injection via sortEvents Parameter www.vulncheck.com
- OSV: CVE-2026-63165 osv.dev
- Vulners: CVE-2026-63165 vulners.com
- Strix: CVE-2026-63165 www.strix.ai
- ThreatInt: CVE-2026-63165 cve.threatint.com
- Agora Project website www.agora-project.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:22.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.