Agora Foundation vulnerabilities and threats

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.4	EPSS 0.3%	CVE-2025-55135Agora · Unrestricted File Upload Medium6.4EPSS 0.3%2025-08-07CVE Database V5CVE-2025-55135 In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG. EPSS 0.3%Vulnerability Agora Foundation CWE-434	CVE Database V5	2025-08-07
Medium	6.4	EPSS 0.3%	CVE-2025-55134Agora · XSS or 'Cross-site Scripting' Medium6.4EPSS 0.3%2025-08-07CVE Database V5CVE-2025-55134 In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js. EPSS 0.3%Vulnerability Agora Foundation CWE-79	CVE Database V5	2025-08-07
Medium	6.4	EPSS 0.3%	CVE-2025-55133Agora · XSS or 'Cross-site Scripting' Medium6.4EPSS 0.3%2025-08-07CVE Database V5CVE-2025-55133 In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js. EPSS 0.3%Vulnerability Agora Foundation CWE-79	CVE Database V5	2025-08-07

Page 1 of 1