CVE-2025-9183

MediumCVSS 6.5/10Last modified Sep 30, 2026

Description

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-451

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2025
Last modified
Sep 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-91848.1Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence CVE-2025-91858.1Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, FireCVE-2025-91866.5Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.CVE-2025-91879.8Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2025-91887.8There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. CVE-2025-91897.8There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB fiCVE-2025-91904.8The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to executeCVE-2025-91916.3The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrCVE-2025-91933.5A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. ExecutiCVE-2025-91944.3The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() funcCVE-2025-91954.4Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of ServiceCVE-2025-91965.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information
CVE-2025-9183: Medium severity, CVSS 6.5 | Vulnix