CVE-2025-55028

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-550297.5Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability waCVE-2025-55038.8A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. This affects the function formMapReboot oCVE-2025-550306.1Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather thCVE-2025-550319.8Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within BluetooCVE-2025-550326.1Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentiallCVE-2025-550336.1Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. CVE-2025-550348.2General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to executCVE-2025-550356.1Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basicCVE-2025-550367.5When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed CVE-2025-550379.3Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.CVE-2025-550386.8An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocoCVE-2025-550396.5This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insec