Omnispace CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Omnispace CVE published 2026-10-13

CVE-2026-63146

A critical vulnerability exists in Omnispace Agora Project versions prior to 26.10.0, allowing for PHP code injection via the config.inc.php file. This issue arises from unescaped, attacker-controlled values being written into the configuration file during installation, combined with an SQL injection vulnerability enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit this [truncated]