Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCateg…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · NIST NVD

   Detected

   Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Commo

2. Oct 15, 2026 · NIST NVD

   Updated

   Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Commo

Sources

• NIST NVDVulnerability recordCVE-2026-63152

  Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without para

  nvd.nist.gov

References

• Reference · github.com
• Reference · agora-project.net
• Reference · vulncheck.com