Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8001 State: PUBLISHED Published: 2025-09-17T20:53:27.719Z Last Updated: 2025-09-18T14:40:10.153Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-119 Description: Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of pro
r open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26053. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-721/
CVE ID: CVE-2025-8002 State: PUBLISHED Published: 2025-09-17T20:53:42.407Z Last Updated: 2025-09-18T14:04:15.808Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-843 Description: Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper
pen a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26233. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-724/
CVE ID: CVE-2025-8003 State: PUBLISHED Published: 2025-09-17T20:53:22.850Z Last Updated: 2025-09-18T14:40:16.507Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-125 Description: Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of pr
or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26235. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-720/
CVE ID: CVE-2025-8004 State: PUBLISHED Published: 2025-09-17T20:53:37.866Z Last Updated: 2025-09-18T14:04:21.560Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-125 Description: Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of pr
or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26236. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-723/
CVE ID: CVE-2025-8005 State: PUBLISHED Published: 2025-09-17T20:53:32.762Z Last Updated: 2025-09-18T14:04:27.112Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-843 Description: Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper
pen a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26237. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-722/
CVE ID: CVE-2025-8006 State: PUBLISHED Published: 2025-09-17T20:53:48.401Z Last Updated: 2025-09-18T14:04:10.062Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-125 Description: Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of pr
or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26238. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-725/
CVE ID: CVE-2025-8007 State: PUBLISHED Published: 2025-09-09T12:29:50.522Z Last Updated: 2025-09-09T13:14:24.284Z Vendors: Rockwell Automation Products: 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT Problem Types: CWE-20 Description: A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Major Non-Recoverable (MNFR) fault. This condition may lead to unexpected system crashes and loss of device availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1739.html
CVE ID: CVE-2025-8008 State: PUBLISHED Published: 2025-09-09T12:27:48.085Z Last Updated: 2025-09-09T13:18:20.601Z Vendors: Rockwell Automation Products: 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT Problem Types: CWE-755 Description: A security issue exists in the protected mode of EN4TR devices, where sending specifically crafted messages during a Forward Close operation can cause the device to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1739.html
CVE ID: CVE-2025-8009 State: PUBLISHED Published: 2025-07-24T07:22:12.991Z Last Updated: 2025-07-24T13:16:52.588Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: cleverplugins Products: Security Ninja – WordPress Security Plugin & Firewall Problem Types: CWE-36 Description: The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server. Additional Analyst Note
l access and above, to extract sensitive data, including the contents of any file on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51ee45f8-9978-48ec-8f87-229dc82938a8?source=cve - https://plugins.trac.wordpress.org/browser/security-ninja/trunk/modules/core-scanner/core-scanner.php#L33 - https://plugins.trac.wordpress.org/browser/security-ninja/trunk/modules/core-scanner/core-scanner.php#L186 - https://plugins.trac.wordpress.org/changeset/3333048/
CVE ID: CVE-2025-8010 State: PUBLISHED Published: 2025-07-22T21:11:18.002Z Last Updated: 2025-08-28T16:38:47.690Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_22.html - https://issues.chromium.org/issues/430344952
CVE ID: CVE-2025-8011 State: PUBLISHED Published: 2025-07-22T21:11:18.602Z Last Updated: 2025-08-28T16:38:35.904Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_22.html - https://issues.chromium.org/issues/430572435
CVE ID: CVE-2025-8013 State: PUBLISHED Published: 2025-08-15T06:40:40.786Z Last Updated: 2025-08-15T12:10:09.215Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: quttera Products: Quttera Web Malware Scanner Problem Types: CWE-918 Description: The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal servic
rary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve - https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352 - https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28 - https://plugins.trac.wordpress.org/changeset/3344330/
CVE ID: CVE-2025-8014 State: PUBLISHED Published: 2025-09-27T16:33:32.601Z Last Updated: 2025-09-30T17:27:13.696Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/556838 - https://hackerone.com/reports/3228134
CVE ID: CVE-2025-8015 State: PUBLISHED Published: 2025-07-22T14:43:08.091Z Last Updated: 2025-07-22T14:55:47.508Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that
possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/deba0a29-7fe5-4f94-bee6-9d01e023215e?source=cve - https://plugins.trac.wordpress.org/changeset/3328729/shortcodes-ultimate
CVE ID: CVE-2025-8017 State: PUBLISHED Published: 2025-07-22T13:32:07.104Z Last Updated: 2025-07-22T13:47:43.904Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg of the component httpd. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317220 - https://vuldb.com/?ctiid.317220 - https://vuldb.com/?submit.619364 - https://github.com/Thir0th/Thir0th-CVE/blob/main/Tenda_AC7%20V1.0_V15.03.06.44%20has%20a%20stack%20overflow%20vulnerability%20in%20parse_macfilter_rule.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-8018 State: PUBLISHED Published: 2025-07-22T14:32:05.436Z Last Updated: 2025-07-22T14:46:59.401Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Food Ordering Review System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Food Ordering Review System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user/reservation_page.php. The manipulation of the argument reg_Id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as we
aunched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317221 - https://vuldb.com/?ctiid.317221 - https://vuldb.com/?submit.619379 - https://github.com/i-Corner/cve/issues/10 - https://code-projects.org/
CVE ID: CVE-2025-8019 State: PUBLISHED Published: 2025-07-22T15:32:05.676Z Last Updated: 2025-07-23T15:02:32.874Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Libituo Technology Products: LBT-T300-T310 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Shenzhen Libituo Technology LBT-T300-T310 2.2.3.6. It has been rated as critical. Affected by this issue is the function sub_40B6F0 of the file at/appy.cgi. The manipulation of the argument wan_proto leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317222 - https://vuldb.com/?ctiid.317222 - https://vuldb.com/?submit.619530 - https://github.com/turing-wue/IoT-vul/blob/main/LBT-T300/README.md - https://github.com/turing-wue/IoT-vul/blob/main/LBT-T300/README.md#payload
CVE ID: CVE-2025-8020 State: PUBLISHED Published: 2025-07-23T05:00:01.625Z Last Updated: 2025-07-23T15:14:07.504Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P) Vendors: n/a Products: private-ip Problem Types: CWE-918 Description: All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757 - https://gist.github.com/lirantal/ed18a4
ichment: References: - https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757 - https://gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1
CVE ID: CVE-2025-8021 State: PUBLISHED Published: 2025-07-23T05:00:03.914Z Last Updated: 2025-07-23T15:03:15.075Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: files-bucket-server Problem Types: CWE-22 Description: All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-FILESBUCKETSERVER-9510944 - https://gist.github.com/lirantal/1f833a7d445e8cfbdcb3e75022954b35%23path-traversal-vulnerability-in-files-bucket-serv
- https://gist.github.com/lirantal/1f833a7d445e8cfbdcb3e75022954b35%23path-traversal-vulnerability-in-files-bucket-server
CVE ID: CVE-2025-8022 State: REJECTED Published: 2025-07-23T05:00:06.702Z Last Updated: 2025-08-11T10:10:46.768Z Description: No description available.
CVE ID: CVE-2025-8023 State: PUBLISHED Published: 2025-08-21T07:51:37.130Z Last Updated: 2025-08-21T14:50:55.341Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-22 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file placement outside intended directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-
intended directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-8027 State: PUBLISHED Published: 2025-07-22T20:49:24.039Z Last Updated: 2025-11-03T20:07:44.121Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1968423 - https://www.mozilla.org/security/advisories/mf
ner: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1968423 - https://www.mozilla.org/security/advisories/mfsa2025-56/ - https://www.mozilla.org/security/advisories/mfsa2025-57/ - https://www.mozilla.org/security/advisories/mfsa2025-58/ - https://www.mozilla.org/security/advisories/mfsa2025-59/ - https://www.mozilla.org/security/advisories/mfsa2025-61/ - https://www.mozilla.org/security/advisories/mfsa2025-62/ - https://www.mozilla.org/security/advisories/mfsa2025-63/
CVE ID: CVE-2025-8028 State: PUBLISHED Published: 2025-07-22T20:49:24.592Z Last Updated: 2025-11-04T15:58:24.124Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1971581 - https
SA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1971581 - https://www.mozilla.org/security/advisories/mfsa2025-56/ - https://www.mozilla.org/security/advisories/mfsa2025-57/ - https://www.mozilla.org/security/advisories/mfsa2025-58/ - https://www.mozilla.org/security/advisories/mfsa2025-59/ - https://www.mozilla.org/security/advisories/mfsa2025-61/ - https://www.mozilla.org/security/advisories/mfsa2025-62/ - https://www.mozilla.org/security/advisories/mfsa2025-63/
CVE ID: CVE-2025-8029 State: PUBLISHED Published: 2025-07-22T20:49:24.898Z Last Updated: 2025-11-04T15:57:41.778Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1928021 - https://www.mozilla.org/security/advisories/mfsa2025-56/ - https://www.mozilla.org/security/advisories/mfsa2025-58/ - https://www.mozill
lla.org/security/advisories/mfsa2025-56/ - https://www.mozilla.org/security/advisories/mfsa2025-58/ - https://www.mozilla.org/security/advisories/mfsa2025-59/ - https://www.mozilla.org/security/advisories/mfsa2025-61/ - https://www.mozilla.org/security/advisories/mfsa2025-62/ - https://www.mozilla.org/security/advisories/mfsa2025-63/
CVE ID: CVE-2025-8030 State: PUBLISHED Published: 2025-07-22T20:49:25.931Z Last Updated: 2025-11-04T15:55:04.949Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1968414 - https://www.mozilla.org/security/advisories/mfsa2025-56/ - https://www.mozilla.org/securit
org/show_bug.cgi?id=1968414 - https://www.mozilla.org/security/advisories/mfsa2025-56/ - https://www.mozilla.org/security/advisories/mfsa2025-58/ - https://www.mozilla.org/security/advisories/mfsa2025-59/ - https://www.mozilla.org/security/advisories/mfsa2025-61/ - https://www.mozilla.org/security/advisories/mfsa2025-62/ - https://www.mozilla.org/security/advisories/mfsa2025-63/