VULNERABILITY INTELLIGENCE
CVE-2025-55135
CVSS score6.4 MEDIUM
EPSS probability0.27%
CISA KEVNot currently listed
Published2025-08-07
Last modified2026-06-17
Description
In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG.