EUVD-2022-30943

Malicious code in bioql PyPI...

EUVD-2022-5852

Malicious code in bioql PyPI...

EUVD-2023-56799

Malicious code in bioql PyPI...

EUVD-2023-29635

Malicious code in bioql PyPI...

EUVD-2023-32127

Malicious code in bioql PyPI...

EUVD-2024-25317

Malicious code in bioql PyPI...

EUVD-2023-12221

Malicious code in bioql PyPI...

EUVD-2024-3486

Malicious code in bioql PyPI...

EUVD-2021-7265

Malicious code in bioql PyPI...

PT-2025-40841

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.5 Description The software contains a cross-site scripting issue that can be triggered when an administrator views the chat log through an IFRAME element. This could potentially lead to session hijacking and data...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

Fiora chat group avatar is vulnerable to XSS via SVG files

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56515

The Fiora chat application (version 1.0.0) is vulnerable to Cross-Site Scripting (XSS) due to a file upload vulnerability in the user avatar functionality. The application fails to validate the content of SVG files , allowing attackers to upload and store malicious files containing elements with...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-56515: Improper Neutralization of Input During Web Page Generation

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2025-57769

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possibl...

CVE-2025-57769 FressRSS: Clickjacking can lead to XSS and/or privilege escalation

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possibl...