MAL-2025-34849 Malicious code in test-mlw2-agora-boult (npm)

The package test-mlw2-agora-boult was found to contain malicious code...

Malicious code in test-mlw2-agora-boult (npm)

The package test-mlw2-agora-boult was found to contain malicious code...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

CVE-2025-55133

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js...

CVE-2025-55133

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js...

PT-2025-32268 · Unknown · Agora Foundation

Name of the Vulnerable Software and Affected Versions: Agora Foundation versions prior to b087490 Description: The software is susceptible to a cross-site scripting XSS issue due to a vulnerability in how tags are handled. This flaw is located in the client/agora/public/js/editorManager.js file...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...

PT-2025-32267 · Agora · Agora Foundation

Name of the Vulnerable Software and Affected Versions: Agora Foundation Agora versions prior to b087490 Description: The application is susceptible to a cross-site scripting XSS issue due to improper handling of the topicName parameter within the client/agora/public/js/editorManager.js file...

CVE-2025-55133

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js...

agora 跨站脚本漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A cross-site scripting vulnerability exists in versions prior to agora fall23-Alpha1 b087490, which stems from the topicName parameter in editorManager.js being susceptible to cross-site scripting attacks...

CVE-2025-55134

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js...

agora 代码问题漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A code issue vulnerability exists in versions prior to agora fall23-Alpha1 690ce56, which stems from a user controller allowing non-standard image formats leading to cross-site scripting attacks...

CVE-2025-55133

CVE-2025-55133 affects Agora Foundation Agora fall23-Alpha1 prior to build b087490 , with a cross-site scripting (XSS) flaw exposed via the topicName parameter in client/agora/public/js/editorManager.js . The underlying issue is improper handling of topicName leading to script injection. The CVSS...

CVE-2025-55133

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js...

CVE-2025-55135

CVE-2025-55135 affects Agora Foundation Agora fall23-Alpha1 prior to patch 690ce56. The issue stems from insufficient file type validation in server/routes/userRoutes.js, allowing non-supported formats (including SVG) for profile pictures and enabling XSS via server/controller/userController.js. ...

agora 跨站脚本漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A cross-site scripting vulnerability exists in versions prior to agora fall23-Alpha1 b087490, which stems from the tag parameter in editorManager.js being susceptible to cross-site scripting attacks...

CVE-2025-55135

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG...