What is CVE-2025-56515?

CVE-2025-56515 is a high-severity vulnerability in Suisuijiang Fiora, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2025-10-01.

How severe is CVE-2025-56515?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2025-56515 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Suisuijiang Fiora

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (39.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Suisuijiang Fiora — versions 1.0.0
N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

cve@mitre.org (Product)
cve@mitre.org (Product)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2025-56515?: CVE-2025-56515 is a high-severity vulnerability in Suisuijiang Fiora, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2025-10-01.
How severe is CVE-2025-56515?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-56515 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.