PT-2026-3023 · Omnispace · Omnispace Agora Project

CVE-2025-67078 · Published 2026-01-15 · Updated 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10

Description A cross site scripting (XSS) issue exists in Omnispace Agora Project. This allows attackers to execute arbitrary code through the notify parameter of the file controller, which is used to display errors.

Recommendations Update to version 25.10 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67078

Affected Products

Omnispace Agora Project

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67078.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67078 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67078 · Vendor Advisory
• https://twitter.com/transilienceai/status/2012729485003567284 · Twitter Post
• https://twitter.com/CVEnew/status/2012490387827396637 · Twitter Post
• https://t.me/cveNotify/149386 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2011846257812086857 · Twitter Post
• https://agora-project.net · Note
• https://helx.io/blog/advisory-agora-project · Note