CVE-2025-27425

MediumCVSS 4.3/10Last modified Oct 5, 2026

Description

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Mar 4, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-274265.4Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was CVE-2025-274274.3A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an addreCVE-2025-274287.7Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled functioCVE-2025-274299.9SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables theCVE-2025-27438.1A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown pCVE-2025-274303.5Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to acCVE-2025-274315.4User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enableCVE-2025-274322.4The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gainCVE-2025-274334.3The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and CVE-2025-274348.8Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote CVE-2025-274354.2Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters ofCVE-2025-274364.3The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a req
CVE-2025-27425: Medium severity, CVSS 4.3 | Vulnix