{“lastseen”:”2025-10-01T17:18:41″,”description”:”Fiora………………………………………………”,”published”:”2025-10-01T00:00:00″,”modified”:”2025-10-01T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Fiora Chat 1.0.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:210055″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-56514″],”sourceData”:”# CVE-2025-56514: Cross Site Scripting (XSS) Vulnerability in Fiora Chat Application\\n \\n ## Overview\\n A Cross Site Scripting (XSS) vulnerability, identified as **CVE-2025-56514**, affects the Fiora chat application version 1.0.0. This vulnerability allows an authenticated user to execute arbitrary JavaScript in the context of another user’s browser by uploading a malicious SVG file through the group avatar change functionality.\\n \\n ## Vulnerability Details\\n – **Vulnerability Type**: Cross Site Scripting (XSS)\\n – **Attack Type**: Remote\\n – **Impact**: Code Execution\\n – **Affected Product Code Base**: Fiora 1.0.0\\n – **Vendor**: suisuijiang\\n – **Discoverer**: Kaio Mendonca Pereira\\n \\n ## Affected Components\\n The following components in the Fiora chat application are impacted:\\n – **Backend**: `packages\/server\/src\/routes\/group.ts` (group management routes)\\n – **Frontend**:\\n – `packages\/web\/src\/modules\/Chat\/GroupManagePanel.tsx` (group avatar upload interface)\\n – `packages\/web\/src\/service.ts` (API service layer)\\n – `packages\/web\/src\/components\/Avatar.ts` (avatar rendering component)\\n \\n ## Attack Vectors\\n An authenticated user with creator privileges in a group can exploit this vulnerability by:\\n 1. Uploading a malicious SVG file containing embedded JavaScript via the \\”Change Group Avatar\\” functionality.\\n 2. The malicious SVG is stored in the `\/GroupAvatar\/` directory.\\n 3. When the SVG avatar is rendered by the `Avatar.tsx` component in another user’s browser, the embedded JavaScript executes, enabling XSS exploitation.\\n \\n ## Steps to Reproduce\\n 1. **Authentication**: Log in to the Fiora chat application with valid credentials.\\n 2. **Access Target Group**: Navigate to group management and select a group where you have creator privileges.\\n 3. **Upload Malicious SVG**: Use the \\”Change Group Avatar\\” feature to upload a malicious SVG file with embedded JavaScript, such as:\\n “`xml\\n \\u003csvg xmlns=\\”http:\/\/www.w3.org\/2000\/svg\\” xmlns:xlink=\\”http:\/\/www.w3.org\/1999\/xlink\\” viewBox=\\”0 0 100 100\\”\\u003e\\n \\u003cforeignObject x=\\”0\\” y=\\”0\\” width=\\”100\\” height=\\”100\\”\\u003e\\n \\u003ciframe xmlns=\\”http:\/\/www.w3.org\/1999\/xhtml\\” src=\\”https:\/\/evil.com\\” onmouseover=\\”alert(document.cookie)\\” width=\\”100\\” height=\\”100\\”\\u003e\\u003c\/iframe\\u003e\\n \\u003c\/foreignObject\\u003e\\n \\u003ctext x=\\”0\\” y=\\”15\\”\\u003e\\u003c\/text\\u003e\\n \\u003c\/svg\\u003e”,”sourceHref”:”https:\/\/packetstorm.news\/download\/210055″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/210055\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-01T17:18:41″,”description”:”Fiora………………………………………………”,”published”:”2025-10-01T00:00:00″,”modified”:”2025-10-01T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Fiora Chat 1.0.0 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:210055″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-56514″],”sourceData”:”# CVE-2025-56514: Cross Site Scripting (XSS) Vulnerability in Fiora Chat Application\\n \\n ## Overview\\n A Cross Site Scripting (XSS)…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-19797","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n