PT-2026-3023 · Omnispace · Omnispace Agora Project

Published 2026-01-15 · Updated 2026-01-21 · CVE-2025-67078

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10

Description A cross site scripting (XSS) issue exists in Omnispace Agora Project. This allows attackers to execute arbitrary code through the notify parameter of the file controller, which is used to display errors.

Recommendations Update to version 25.10 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67078

Affected Products

Omnispace Agora Project

References · 8

• https://osv.dev/vulnerability/CVE-2025-67078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67078 · Security Note
• https://twitter.com/VulmonFeeds/status/2011846257812086857 · Twitter Post
• https://twitter.com/CVEnew/status/2012490387827396637 · Twitter Post
• https://helx.io/blog/advisory-agora-project · Note
• https://t.me/cveNotify/149386 · Telegram Post
• https://agora-project.net · Note
• https://twitter.com/transilienceai/status/2012729485003567284 · Twitter Post