CVE-2025-67078

—

CVSS 3.1

6.1 medium

EPSS

<1%p9

Published

Jan 15, 2026 (Jan 15, 2026)

Modified

Jun 17, 2026

Description

Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used to display errors.

Vendors: agora-project
Products: agora-project
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.