CVE-2025-6434

MediumCVSS 4.3/10Last modified Sep 30, 2026

Description

The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2025
Last modified: Sep 30, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-643407.8FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters (e.g.,CVE-2025-643426.9ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection CVE-2025-643437.8(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the inst CVE-2025-643447.5Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior CVE-2025-643451.8Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound CVE-2025-643466.0archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially craft CVE-2025-643477.5Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.CVE-2025-643487.1ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is CVE-2025-643498.8ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a passw CVE-2025-64358.1If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with th CVE-2025-643503.8Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control CVE-2025-643514.3Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sen