Agora Foundation Agora

• CVE-2025-55135 Medium 6.4 In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes 0.3%
• CVE-2025-55133 Medium 6.4 In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js. 0.3%
• CVE-2025-55134 Medium 6.4 In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js. 0.3%