GCVE - cpe:2.3:a:suisuijiang:fiora:1.0.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:suisuijiang:fiora:1.0.0:*:*:*:*:*:*:*

part: a version: 1.0.0 update: *

Vendor	Suisuijiang (`50b5fe3e-e730-56ce-a6db-b1d90a034d73`)
Product	Fiora (`a94ca94d-cbe1-53ec-8ab7-58a68c6fff64`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-56515`	vulnerable	2026-06-08 07:33:15.648508	Details available File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles. Published: 2025-10-01T00:00:00.000Z Updated: 2025-10-01T15:50:25.946Z Open on db.gcve.eu Reference links https://github.com/yinxin630/fiora https://fiora.suisuijiang.com/ https://github.com/Kov404/CVE-2025-56515/tree/main	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56514`	vulnerable	2026-06-08 07:33:15.648056	Details available Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users. Published: 2025-10-01T00:00:00.000Z Updated: 2025-10-21T20:00:49.065Z Open on db.gcve.eu Reference links https://github.com/yinxin630/fiora https://fiora.suisuijiang.com/ https://github.com/Kov404/CVE-2025-56514/tree/main	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.