CVE-2026-63167

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can...

CVE-2026-63170

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id from predictable fields such as object creation time, which is self-disclosed through autorDate and t...

CVE-2026-63151

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5calendarId.userId, both small enumerable integer...

CVE-2026-63150

Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link ...

CVE-2026-63164

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj without a readRight ownership check in CtrlMail.php...

CVE-2026-63166

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only...

CVE-2026-63155

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir function. Attackers can craft login links with objUrl set to a malicious site, causing...

CVE-2026-63173

Omnispace Agora Project through version 26.10.0 is vulnerable to a broken access control issue in the isAutor() function within MdlObject.php. The flaw occurs because the system grants accessRight=3 based strictly on object authorship without verifying if the user still belongs to the object's sp...

CVE-2026-63173 Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()

Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and...

CVE-2026-63170 Omnispace Agora Project 26.10.0 Predictable Share Token via md5Id

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id from predictable fields such as object creation time, which is self-disclosed through autorDate and t...

CVE-2026-63170

Omnispace Agora Project (versions through 26.10.0 ) is vulnerable to a predictable token generation issue. An unauthenticated attacker can forge a shared-calendar iCal share token by deriving the md5Id() from predictable fields, such as the object creation time , which is disclosed via autorDate ...

CVE-2026-63167

The Omnispace Agora Project (versions through 26.10.0 ) is vulnerable to a SQL injection flaw. This issue occurs because the personsSort session value is concatenated unsanitized into ORDER BY clauses within the MdlUser.php and MdlSpace.php files. Authenticated general administrators can exploit ...

CVE-2026-63167 Omnispace Agora Project 26.10.0 SQL Injection via personsSort Session Value

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can...

CVE-2026-63166

Omnispace Agora Project versions through 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in VuePersonsImportExport.php , where values from imported directory data or uploaded CSV files are rendered into table cell text and value attributes using only T...

CVE-2026-63166 Omnispace Agora Project 26.10.0 Stored XSS via CSV Import Preview

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only...

CVE-2026-63164

The Omnispace Agora Project (through version 26.10.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the Ctrl::getCurObj() function in CtrlMail.php fails to perform a readRight() ownership check when processing the reloadMailTypeId parameter. This allows au...

CVE-2026-63164 Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj without a readRight ownership check in CtrlMail.php...

CVE-2026-63155 Omnispace Agora Project 26.10.0 Open Redirect via objUrl Parameter

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir function. Attackers can craft login links with objUrl set to a malicious site, causing...

CVE-2026-63155

The Omnispace Agora Project (through version 26.10.0 ) is vulnerable to an open redirect vulnerability. The root cause is located in the redir() function of Ctrl.php , where an attacker can manipulate the objUrl parameter to redirect users to arbitrary external URLs. By crafting malicious login l...

CVE-2026-63151

Omnispace Agora Project versions through 26.10.0 are vulnerable to a predictable token generation flaw. The root cause is a missing dateCrea value, which causes the md5Id token to collapse into md5(calendarId.userId). Since both calendarId and userId are small enumerable integers, an unauthentica...