CVE-2025-55135 – Agora Foundation Agora XSS via SVG Profile Picture

CVE ID : CVE-2025-55135

Published : Aug. 7, 2025, 4:15 p.m. | 1 hour, 14 minutes ago

Description : In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…