deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-23234
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
CVSS Score: 3.3 (LOW)
CWE: CWE-120
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-23240
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-23409
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-23414
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-23418
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-23420
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-24301
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-24309
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-1306
Published: 2025-03-04
Description: The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://themes.trac.wordpress.org/browser/newscrunch/1.8.3/functions.php#L486; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=261789%40newscrunch&new=261789%40newscrunch&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c507681-61e9-4bf0-8fe5-e2f401a7a8be?source=cve
CVE: CVE-2025-1307
Published: 2025-03-04
Description: The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://themes.trac.wordpress.org/browser/newscrunch/1.8.3/functions.php#L486; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=261789%40newscrunch&new=261789%40newscrunch&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b55567e9-24e6-4738-b7f7-b95b541e6067?source=cve
CVE: CVE-2025-1904
Published: 2025-03-04
Description: A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionality of the file /Blood/A+.php. The manipulation of the argument Availibility leads to cross site scripting. The attack may be launched remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/lokihardk/cve/blob/main/xss-2_25.md; https://vuldb.com/?ctiid.298424
CVE: CVE-2025-1905
Published: 2025-03-04
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file employee.php. The manipulation of the argument Full Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/sorcha-l/cve/blob/main/Employee%20Management%20System%20by%20rems%20has%20xss.md; https://vuldb.com/?ctiid.298425; https://vuldb.com/?id.298425
CVE: CVE-2025-1906
Published: 2025-03-04
Description: A vulnerability has been found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/HaroldFinch-L/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.298426
CVE: CVE-2024-13685
Published: 2025-03-04
Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85/
CVE: CVE-2024-47259
Published: 2025-03-04
Description: Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files to the Axis device with the purpose to exhaust system resources. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 3.5 (LOW)
CWE: CWE-434
References: https://www.axis.com/dam/public/13/cd/4a/cve-2024-47259pdf-en-US-466882.pdf
CVE: CVE-2024-47260
Published: 2025-03-04
Description: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-641
References: https://www.axis.com/dam/public/1d/d3/ef/cve-2024-47260pdf-en-US-466883.pdf
CVE: CVE-2024-47262
Published: 2025-03-04
Description: Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or services not making use of param.cgi are not affected. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1287
References: https://www.axis.com/dam/public/a3/18/6e/cve-2024-47262pdf-en-US-466884.pdf
CVE: CVE-2025-0359
Published: 2025-03-04
Description: During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. 
Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CVSS Score: 8.5 (HIGH)
CWE: CWE-863
References: https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf
CVE: CVE-2025-0360
Published: 2025-03-04
Description: During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://www.axis.com/dam/public/b1/fe/46/cve-2025-0360pdf-en-US-466887.pdf
CVE: CVE-2024-48248
Published: 2025-03-04
Description: NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
CVSS Score: 8.6 (HIGH)
CWE: CWE-36
References: https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm; https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/; https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com
CVE: CVE-2024-58043
Published: 2025-03-04
Description: Permission bypass vulnerability in the window module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.3 (HIGH)
CWE: CWE-840
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58044
Published: 2025-03-04
Description: Permission verification bypass vulnerability in the notification module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58045
Published: 2025-03-04
Description: Multi-concurrency vulnerability in the media digital copyright protection module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58046
Published: 2025-03-04
Description: Permission management vulnerability in the lock screen module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-840, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58047
Published: 2025-03-04
Description: Permission verification vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58048
Published: 2025-03-04
Description: Multi-thread problem vulnerability in the package management module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58049
Published: 2025-03-04
Description: Permission verification vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-58050
Published: 2025-03-04
Description: Vulnerability of improper access permission in the HDC module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2025-27521
Published: 2025-03-04
Description: Vulnerability of improper access permission in the process management module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-280, CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE: CVE-2024-13682
Published: 2025-03-04
Description: The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3244479%40wallet-system-for-woocommerce%2Ftrunk&old=3231275%40wallet-system-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/779a9f7a-4582-4d5e-bd9a-9ff7f14b452a?source=cve
CVE: CVE-2024-13724
Published: 2025-03-04
Description: The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3244479%40wallet-system-for-woocommerce%2Ftrunk&old=3231275%40wallet-system-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/bda326b0-9049-496a-a600-fa65151ce98f?source=cve
CVE: CVE-2024-9618
Published: 2025-03-04
Description: The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://master-addons.com/changelogs/; https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/js/master-addons-scripts.js#L1030; https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/js/master-addons-scripts.js#L1993
CVE: CVE-2025-0433
Published: 2025-03-04
Description: The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-hover-effects/ma-image-hover-effects.php#L1117; https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tabs/ma-tabs.php#L568; https://plugins.trac.wordpress.org/changeset/3243199/
CVE: CVE-2025-0512
Published: 2025-03-04
Description: The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 6.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/structured-content/trunk/templates/shortcodes/local-business.php#L10; https://plugins.trac.wordpress.org/changeset/3248930/; https://wordpress.org/plugins/structured-content/#developers
CVE: CVE-2025-26849
Published: 2025-03-04
Description: There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1394
References: https://docs.docusnap.com/en/release-notes/changelog/; https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-012/; https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-012/
CVE: CVE-2025-0370
Published: 2025-03-04
Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75; https://plugins.trac.wordpress.org/changeset/3229060/; https://wordpress.org/plugins/shortcodes-ultimate/#developers
CVE: CVE-2025-0958
Published: 2025-03-04
Description: The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pages and allows them to execute other actions related to auction handling.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ajax-actions/send-private-msg.php#L35; https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L219; https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L274
CVE: CVE-2025-22224
Published: 2025-03-04
Description: VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-367, CWE-367
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22224
CVE: CVE-2025-22225
Published: 2025-03-04
Description: VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-123
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22225
CVE: CVE-2025-22226
Published: 2025-03-04
Description: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226
CVE: CVE-2025-1925
Published: 2025-03-04
Description: A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm_context of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20PDU%20Session%20ID%20Conflict; https://github.com/open5gs/open5gs/pull/3711; https://vuldb.com/?ctiid.298513
CVE: CVE-2025-1930
Published: 2025-03-04
Description: On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1902309; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-15/
CVE: CVE-2025-1931
Published: 2025-03-04
Description: It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1944126; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-15/
CVE: CVE-2025-1932
Published: 2025-03-04
Description: An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1944313; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-16/