CVE-2025-67078: XSS
Published Jan 15, 2026
·Updated
Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used to display errors.
Affected Software
2 affected components
Omnispace Agora Project<25.10
Agora-Project Agora-Project<25.10
Event History
Jan 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67078?
The severity of CVE-2025-67078 is considered high due to its nature of allowing attackers to execute arbitrary code.
2
How do I fix CVE-2025-67078?
To fix CVE-2025-67078, upgrade Omnispace Agora Project to version 25.10 or later.
3
What kind of vulnerability is CVE-2025-67078?
CVE-2025-67078 is a cross-site scripting (XSS) vulnerability that can be exploited through the notify parameter.
4
What is affected by CVE-2025-67078?
CVE-2025-67078 affects all versions of Omnispace Agora Project prior to 25.10.
5
Can CVE-2025-67078 lead to data exposure?
Yes, CVE-2025-67078 can potentially lead to data exposure because it allows attackers to execute arbitrary scripts.