Threats tagged 'ghsa-35vx-ffcf-7cr8'

Omnispace Agora Project versions prior to 26.10.0 have a SQL injection vulnerability in the calendar functionality. The flaw arises from unsanitized concatenation of the sortEvents parameter into the ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation can allow attackers to extract sensitive database information using error-based SQL injection techniques.