agora-project records

8 published records for vendor agora-project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2025-67079No exploit	File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick lagora-project · agora-project · CWE-434 Pre-auth File upload	Critical9.8	—	0.4%	Jan 15, 2026
35Monitor	CVE-2025-67077No exploit	File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via agora-project · agora-project · CWE-434 File upload	High8.8	—	0.3%	Jan 15, 2026
30Monitor	CVE-2025-67076No exploit	Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system viaagora-project · agora-project · CWE-22 Pre-auth Path traversal	High7.5	—	0.8%	Jan 15, 2026
24Monitor	CVE-2017-6562No exploit	XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=[XSS] attack.agora-project · agora-project · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Mar 9, 2017
24Monitor	CVE-2017-6559No exploit	XSS in Agora-Project 3.2.2 exists with an index.php?disconnect=1&msgNotif[]=[XSS] attack.agora-project · agora-project · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Mar 9, 2017
24Monitor	CVE-2017-6561No exploit	XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=[XSS] attack.agora-project · agora-project · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Mar 9, 2017
24Monitor	CVE-2017-6560No exploit	XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=[XSS]&editObjId=[XSS] attack.agora-project · agora-project · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Mar 9, 2017
24Monitor	CVE-2025-67078No exploit	Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notifyagora-project · agora-project · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Jan 15, 2026

CVE-2025-67079
39Monitor
File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick l
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
agora-project · agora-projectJan 15, 2026
CVE-2025-67077
35Monitor
File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via
HighCVSS 8.8No exploitEPSS 0%
- File upload
agora-project · agora-projectJan 15, 2026
CVE-2025-67076
30Monitor
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
agora-project · agora-projectJan 15, 2026
CVE-2017-6562
24Monitor
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=[XSS] attack.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
agora-project · agora-projectMar 9, 2017
CVE-2017-6559
24Monitor
XSS in Agora-Project 3.2.2 exists with an index.php?disconnect=1&msgNotif[]=[XSS] attack.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
agora-project · agora-projectMar 9, 2017
CVE-2017-6561
24Monitor
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=[XSS] attack.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
agora-project · agora-projectMar 9, 2017
CVE-2017-6560
24Monitor
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=[XSS]&editObjId=[XSS] attack.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
agora-project · agora-projectMar 9, 2017
CVE-2025-67078
24Monitor
Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
agora-project · agora-projectJan 15, 2026