CVE-2025-55133

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js...

agora 跨站脚本漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A cross-site scripting vulnerability exists in versions prior to agora fall23-Alpha1 b087490, which stems from the topicName parameter in editorManager.js being susceptible to cross-site scripting attacks...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2025-55133

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js...

agora 代码问题漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A code issue vulnerability exists in versions prior to agora fall23-Alpha1 690ce56, which stems from a user controller allowing non-standard image formats leading to cross-site scripting attacks...

CVE-2025-55135

CVE-2025-55135 affects Agora Foundation Agora fall23-Alpha1 prior to patch 690ce56. The issue stems from insufficient file type validation in server/routes/userRoutes.js, allowing non-supported formats (including SVG) for profile pictures and enabling XSS via server/controller/userController.js. ...

CVE-2025-55133

CVE-2025-55133 affects Agora Foundation Agora fall23-Alpha1 prior to build b087490 , with a cross-site scripting (XSS) flaw exposed via the topicName parameter in client/agora/public/js/editorManager.js . The underlying issue is improper handling of topicName leading to script injection. The CVSS...

CVE-2025-55134: Improper Neutralization of Input During Web Page Generation

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2025-55135: Unrestricted Upload of File with Dangerous Type

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-55134

Affected software: Agora Foundation fall23-Alpha1 (pre-b087490). The vulnerability is a client-side cross-site scripting (XSS) in editorManager.js caused by improper handling of the tag parameter. Impact is XSS exposure via that field; no exploitation details are provided beyond this. Mitigation:...

agora 跨站脚本漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A cross-site scripting vulnerability exists in versions prior to agora fall23-Alpha1 b087490, which stems from the tag parameter in editorManager.js being susceptible to cross-site scripting attacks...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

PT-2025-32269 · Unknown · Agora Foundation

Name of the Vulnerable Software and Affected Versions: Agora Foundation Agora fall23-Alpha1 versions prior to 690ce56 Description: The application permits file formats other than PNG, JPEG, and WEBP for profile pictures, including SVG. This allows for cross-site scripting XSS via a crafted profil...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2021-38621

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership...

CVE-2020-25605

Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic...

CVE-2002-2128

editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...

Malicious code in agora-rtc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bed49b7fcfa2244aaa6560e20fdf121f7551e8856e6e43f34eb8be1f4a998cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...