Fiora chat user avatar is vulnerable to XSS via SVG files

中危 5.4CVE-2025-56514 · GHSA-hg3j-6pmh-mvjr · Published 01/10/2025 · updated 05/11/2026

要点

CVE-2025-56514 是影响 fiora (suisuijiang), fiora 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.29%，高于 21.4% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
fiora suisuijiang	`= 1.0.0`	No fix yet
fiora npm	`= 1.0.0`	No fix yet

Description

Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users.

NVD description

Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users.

References

nvd.nist.gov/vuln/detail/CVE-2025-56514 · ADVISORY
fiora.suisuijiang.com · WEB
Kov404/CVE-2025-56514 · WEB
yinxin630/fiora · PACKAGE
fiora.suisuijiang.com · Product

fiora 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free