CVE-2025-14744

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-451

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Mozilla	Firefox for iOS	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1984683Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-97/Vendor Advisory

Timeline

Published: Dec 18, 2025
Last modified: Oct 5, 2026
NVD status: Undergoing Analysis

Related CVEs from 2025

CVE-2025-147456.4The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2025-147466.5A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video St CVE-2025-147476.5A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the component RTSP Service. Performin CVE-2025-147485.4A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the compo CVE-2025-147498.8A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the compo CVE-2025-14759.8The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to ins CVE-2025-147508.7The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-pri CVE-2025-147518.7A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthori CVE-2025-147537.5IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted CVE-2025-147548.8IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to i CVE-2025-147555.3The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (I CVE-2025-147568.8Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attac