CVE-2025-56515

Katalog CVE

CVSS 8.8 · High EPSS 0,52%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada suisuijiang fiora. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles.

Rincian

Terbit di NVD

1 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Kov404/CVE-2025-56515/tree/main exploit · advisory pihak ketiga
• https://fiora.suisuijiang.com/ product
• https://github.com/yinxin630/fiora product