CVE-2025-54144

MediumCVSS 5.4/10Last modified Oct 5, 2026

Description

The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-541459.1The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's opeCVE-2025-541466.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541476.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541486.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541495.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541505.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541515.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541526.5A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, theCVE-2025-541538.8An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-541546.8An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can thenCVE-2025-541554.9An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gainsCVE-2025-541567.5The Sante PACS Server Web Portal sends credential information without encryption.
CVE-2025-54144: Medium severity, CVSS 5.4 | Vulnix