What is CVE-2025-67078?

CVE-2025-67078 is a medium-severity vulnerability in Agora-project, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-01-15.

How severe is CVE-2025-67078?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Agora-project

CVE-2025-67078

Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used to display errors.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (8.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Agora-project
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Product)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2025-67078?: CVE-2025-67078 is a medium-severity vulnerability in Agora-project, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-01-15.
How severe is CVE-2025-67078?: Medium severity. CVSS v3 base score is 6.1 out of 10.