Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63146— Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

Quick assessment

Affected

Omnispace Agora Project

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Omnispace Agora Project 在 26.10.0 版本之前存在代码注入漏洞，其中未经过转义的、由攻击者控制的值在安装过程中通过 File::updateConfigFile() 和 DbInstall::dbControl() 方法写入 config.inc.php 配置文件中。结合一个由 PDO::ATTR_EMULATE_PREPARES 支持堆叠查询引发的 SQL 注入漏洞，攻击者可以利用该 SQL 注入漏洞重新触发安装程序，并将任意 PHP 代码注入到 config.inc.php 文件中

CVSS 9.8 · Critical EPSS 0.66% · P50 Updated Oct 14, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Omnispace	Agora Project	`< 26.10.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

Source: CVE Program / CVE List V5

Vulnerability Description

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Omnispace	Agora Project	0 ~ 26.10.0	-

II. Public POCs for CVE-2026-63146

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63146

请登录查看更多情报信息。

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

CVE-2026-63161	8.8 HIGH	Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
CVE-2026-63162	8.8 HIGH	Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
CVE-2026-63154	8.8 HIGH	Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
CVE-2026-63153	8.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
CVE-2026-63174	8.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
CVE-2026-63165	8.1 HIGH	Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
CVE-2026-63152	8.1 HIGH	Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
CVE-2026-63163	7.5 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
CVE-2026-63149	7.4 HIGH	Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
CVE-2026-63158	7.4 HIGH	Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
CVE-2026-63159	7.4 HIGH	Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
CVE-2026-63160	7.4 HIGH	Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
CVE-2026-63172	7.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
CVE-2026-63169	6.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe
CVE-2026-63156	6.1 MEDIUM	Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
CVE-2026-63147	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
CVE-2026-63148	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
CVE-2026-63168	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
CVE-2026-63171	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
CVE-2026-63157	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

IV. Related Vulnerabilities

Same product: Agora Project

Same vendor: Omnispace

Same weakness: CWE-94

V. Comments for CVE-2026-63146

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63146— Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

Quick assessment

Possible ATT&CK Techniques 3 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-63146

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-63146

III. Intelligence Information for CVE-2026-63146

Patches & Fixes for CVE-2026-63146 (1)

Vendor Advisories for CVE-2026-63146 (1)

Vendor Pages for CVE-2026-63146 (1)

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-63146

Leave a comment