CVE-2026-63167

MediumCVSS 6.5/10Last modified Nov 13, 2026

Description

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-631685.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist u CVE-2026-631696.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages CVE-2026-63178.8Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2026-631703.7Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge CVE-2026-631715.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject ma CVE-2026-631727.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to cr CVE-2026-631735.4Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php gran CVE-2026-631748.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into CVE-2026-631757.1PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variabl CVE-2026-631777.1Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua la CVE-2026-631786.5Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manag CVE-2026-631794.9Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend