CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-55134

Affected software: Agora Foundation fall23-Alpha1 (pre-b087490). The vulnerability is a client-side cross-site scripting (XSS) in editorManager.js caused by improper handling of the tag parameter. Impact is XSS exposure via that field; no exploitation details are provided beyond this. Mitigation:...

PT-2025-32269 · Unknown · Agora Foundation

Name of the Vulnerable Software and Affected Versions: Agora Foundation Agora fall23-Alpha1 versions prior to 690ce56 Description: The application permits file formats other than PNG, JPEG, and WEBP for profile pictures, including SVG. This allows for cross-site scripting XSS via a crafted profil...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2021-38621

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership...

CVE-2020-25605

Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic...

CVE-2002-2128

editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...

Malicious code in agora-rtc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bed49b7fcfa2244aaa6560e20fdf121f7551e8856e6e43f34eb8be1f4a998cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9495 Malicious code in agora-rtc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bed49b7fcfa2244aaa6560e20fdf121f7551e8856e6e43f34eb8be1f4a998cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in agora-daily-conversion (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1735 Malicious code in agora-daily-conversion (npm)

--- -= Per source details. Do not edit below this line.=-...

admin-console 跨站脚本漏洞

admin-console is a Sequent open source Agora core view management interface. A cross-site scripting vulnerability exists in admin-console version 6.1.7 and earlier. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

project.athens-agora.gr Cross Site Scripting vulnerability OBB-3868828

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agora-tec.fr Cross Site Scripting vulnerability OBB-3502090

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agora-tec.fr Cross Site Scripting vulnerability OBB-3490654

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agora-conseil.fr Cross Site Scripting vulnerability OBB-3480779

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agora-tec.fr Cross Site Scripting vulnerability OBB-3438523

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

project.athens-agora.gr Cross Site Scripting vulnerability OBB-3427888

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agora-tec.fr Cross Site Scripting vulnerability OBB-3395274

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...