Medium severity · published Mar 9, 2017
CVE-2017-6561
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=[XSS] attack
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=[XSS] attack.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Agora-project · Agora-project
3.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6561
Third Party Advisory
http://www.securityfocus.com/bid/96940
Exploit
https://packetstormsecurity.com/files/141507/Agora-Project-3.2.2-Cross-Site-Scripting.html
More from Agora-project
9.8
CVE-2025-67079
File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file…
8.8
CVE-2025-67077
File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action
7.5
CVE-2025-67076
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the…
6.1
CVE-2025-67078
Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used…
6.1
CVE-2017-6562
XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=[XSS] attack