CVE-2025-56514

MEDIUM

Fiora 1.0.0 - Stored Cross-Site Scripting via Malicious SVG File Rendering

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-56514. PoCs published by Kov404.

AI-analyzed exploit summary This repository provides a detailed writeup for CVE-2025-56514, an XSS vulnerability in Fiora chat application version 1.0.0, exploitable via malicious SVG file uploads in group avatars.

Description

Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users.

Exploits (1)

nomisec WRITEUP
by Kov404 · poc
https://github.com/Kov404/CVE-2025-56514

This repository provides a detailed writeup for CVE-2025-56514, an XSS vulnerability in Fiora chat application version 1.0.0, exploitable via malicious SVG file uploads in group avatars.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: Fiora chat application 1.0.0
Auth required
Prerequisites: Authenticated user with group creator privileges · Access to group management interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 5.4
EPSS 0.0001
EPSS Percentile 1.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
npm/fiora npm
suisuijiang/fiora 1.0.0
Published Oct 01, 2025
Tracked Since Feb 18, 2026