Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1906 State: PUBLISHED Published: 2025-03-04T05:00:10.621Z Last Updated: 2025-03-04T14:32:08.923Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Restaurant Table Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA A
disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298426 - https://vuldb.com/?ctiid.298426 - https://vuldb.com/?submit.508915 - https://github.com/HaroldFinch-L/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-1907 State: PUBLISHED Published: 2025-05-29T23:12:12.540Z Last Updated: 2025-05-30T12:50:37.021Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Instantel Products: Micromate Problem Types: CWE-306 Description: Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-04 - https://www.instantel.com/service-and-support/contact-technical-support
CVE ID: CVE-2025-1908 State: PUBLISHED Published: 2025-04-24T07:30:51.255Z Last Updated: 2025-04-24T15:23:23.164Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-840 Description: An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/523065 - https://hackerone.com/reports/3016623
CVE ID: CVE-2025-1909 State: PUBLISHED Published: 2025-05-05T19:42:25.763Z Last Updated: 2025-05-05T20:01:47.215Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BuddyBoss Products: BuddyBoss Platform Pro Problem Types: CWE-288 Description: The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Addit
attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce9b8b-0589-4b09-b184-a66fc86fcb46?source=cve - https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/ - https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/2-7-10/
CVE ID: CVE-2025-1911 State: PUBLISHED Published: 2025-03-26T11:55:52.549Z Last Updated: 2025-03-26T13:18:52.969Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: webtoffee Products: Product Import Export for WooCommerce – Import Export Product CSV Suite Problem Types: CWE-73 Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log file
s makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d222ef6d-cdec-482e-92ba-65eeabbcdeae?source=cve - https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L248 - https://wordpress.org/plugins/product-import-export-for-woo/#developers - https://plugins.trac.wordpress.org/changeset/3261194/
CVE ID: CVE-2025-1912 State: PUBLISHED Published: 2025-03-26T11:55:51.801Z Last Updated: 2025-03-26T13:19:50.402Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: webtoffee Products: Product Import Export for WooCommerce – Import Export Product CSV Suite Problem Types: CWE-918 Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from th
ed attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/406b52dc-3d36-4b03-a932-34f456395979?source=cve - https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php#L175 - https://wordpress.org/plugins/product-import-export-for-woo/#developers - https://plugins.trac.wordpress.org/changeset/3261194/
CVE ID: CVE-2025-1913 State: PUBLISHED Published: 2025-03-26T11:55:53.001Z Last Updated: 2025-03-26T13:13:37.240Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webtoffee Products: Product Import Export for WooCommerce – Import Export Product CSV Suite Problem Types: CWE-502 Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known P
s it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4464bb1-273a-42c4-a7ec-8e123d286963?sour
hment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4464bb1-273a-42c4-a7ec-8e123d286963?source=cve - https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php - https://wordpress.org/plugins/product-import-export-for-woo/#developers - https://plugins.trac.wordpress.org/changeset/3261194/
CVE ID: CVE-2025-1914 State: PUBLISHED Published: 2025-03-05T03:48:35.445Z Last Updated: 2025-03-06T04:55:20.864Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/397731718
CVE ID: CVE-2025-1915 State: PUBLISHED Published: 2025-03-05T03:48:35.884Z Last Updated: 2025-03-06T04:55:22.246Z Vendors: Google Products: Chrome Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/391114799
CVE ID: CVE-2025-1916 State: PUBLISHED Published: 2025-03-05T03:48:36.146Z Last Updated: 2025-03-06T04:55:13.989Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/376493203
CVE ID: CVE-2025-1917 State: PUBLISHED Published: 2025-03-05T03:48:36.375Z Last Updated: 2025-03-05T14:29:03.280Z Vendors: Google Products: Chrome Problem Types: CWE-1021 Description: Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/329476341
CVE ID: CVE-2025-1918 State: PUBLISHED Published: 2025-03-05T03:48:36.637Z Last Updated: 2025-03-06T04:55:11.229Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/388557904
CVE ID: CVE-2025-1919 State: PUBLISHED Published: 2025-03-05T03:48:36.844Z Last Updated: 2025-03-06T04:55:12.639Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/392375312
CVE ID: CVE-2025-1920 State: PUBLISHED Published: 2025-03-10T20:39:16.505Z Last Updated: 2025-03-12T04:00:38.448Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/398065918
CVE ID: CVE-2025-1921 State: PUBLISHED Published: 2025-03-05T03:48:37.204Z Last Updated: 2025-03-05T14:24:46.660Z Vendors: Google Products: Chrome Problem Types: CWE-1230 Description: Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about a peripheral via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/387583503
CVE ID: CVE-2025-1922 State: PUBLISHED Published: 2025-03-05T03:48:37.428Z Last Updated: 2025-03-05T14:23:17.785Z Vendors: Google Products: Chrome Problem Types: CWE-451 Description: Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/384033062
CVE ID: CVE-2025-1923 State: PUBLISHED Published: 2025-03-05T03:48:37.668Z Last Updated: 2025-03-05T14:22:19.369Z Vendors: Google Products: Chrome Problem Types: CWE-1021 Description: Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/382540635
CVE ID: CVE-2025-1925 State: PUBLISHED Published: 2025-03-04T13:09:24.363Z Last Updated: 2025-03-04T14:18:52.896Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Open5GS Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm_context of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and caus
allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298513 - https://vuldb.com/?ctiid.298513 - https://vuldb.com/?submit.506038 - https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20PDU%20Session%20ID%20Conflict
s://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20PDU%20Session%20ID%20Conflict - https://github.com/open5gs/open5gs/pull/3711
CVE ID: CVE-2025-1926 State: PUBLISHED Published: 2025-03-10T04:21:10.711Z Last Updated: 2025-03-10T17:04:32.142Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: softaculous Products: Page Builder: Pagelayer – Drag and Drop website builder Problem Types: CWE-352 Description: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site a
it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/542b6312-b264-49d5-882a-454427c60c8a?source=cve - https://plugins.trac.wordpress.org/browser/pagelayer/tags/1.9.8/init.php#L477
CVE ID: CVE-2025-1929 State: PUBLISHED Published: 2025-08-15T12:06:43.436Z Last Updated: 2025-08-15T12:57:31.198Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Risk Yazılım Teknolojileri Ltd. Şti. Products: Reel Sektör Hazine ve Risk Yönetimi Yazılımı Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve Risk Yönetimi Yazılımı allows SQL Injection, CAPEC - 7 - Blind SQL Injection.This issue affects Reel Sektör Hazine ve Risk Yönetimi Yazılımı: through 1.0.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
el Sektör Hazine ve Risk Yönetimi Yazılımı: through 1.0.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0198
CVE ID: CVE-2025-1930 State: PUBLISHED Published: 2025-03-04T13:31:22.418Z Last Updated: 2025-03-05T16:42:55.992Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: AudioIPC StreamData could trigger a use-after-free in the Browser process Description: On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=19023
8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1902309 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-15/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1931 State: PUBLISHED Published: 2025-03-04T13:31:23.221Z Last Updated: 2025-11-03T20:57:15.155Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in WebTransportChild Description: It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1944126 - https://www.mozilla.org/security/advisories
tainer: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1944126 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-15/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1932 State: PUBLISHED Published: 2025-03-04T13:31:23.551Z Last Updated: 2025-11-03T20:57:16.609Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Inconsistent comparator in XSLT sorting led to out-of-bounds access Description: An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1944313 - https://www.mozilla.org
t: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1944313 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1933 State: PUBLISHED Published: 2025-03-04T13:31:23.856Z Last Updated: 2025-11-03T20:57:18.028Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: JIT corruption of WASM i32 return values on 64-bit CPUs Description: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1946
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1946004 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-15/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1934 State: PUBLISHED Published: 2025-03-04T13:31:24.734Z Last Updated: 2025-11-03T20:57:19.643Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Unexpected GC during RegExp bailout processing Description: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1942881 - https://www.mozilla.org
t: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1942881 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1935 State: PUBLISHED Published: 2025-03-04T13:31:25.890Z Last Updated: 2025-11-03T20:57:21.111Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Clickjacking the registerProtocolHandler info-bar Description: A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1866661 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/
g/show_bug.cgi?id=1866661 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/