CVE-2025-1015

The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.

• CWE-79

• https://bugzilla.mozilla.org/show_bug.cgi?id=1939458Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-11/

Published

Feb 4, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10143The Catch Dark Mode plugin for WordPress is vulnerable to Lo…7.5
• CVE-2025-10144The Perfect Brands for WooCommerce plugin for WordPress is v…6.5
• CVE-2025-10145Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-10146The Download Manager plugin for WordPress is vulnerable to R…6.1
• CVE-2025-10147The Podlove Podcast Publisher plugin for WordPress is vulner…9.8
• CVE-2025-10148curl's websocket code did not update the 32 bit mask pattern…5.3
• CVE-2025-10150Webserver crash caused by scanning on TCP port 80 in Softing…8.7
• CVE-2025-10151Improper locking vulnerability in Softing Industrial Automat…7.2
• CVE-2025-10155An Improper Input Validation vulnerability in the scanning l…7.8
• CVE-2025-10156An Improper Handling of Exceptional Conditions vulnerability…9.8
• CVE-2025-10157A Protection Mechanism Failure vulnerability in mmaitre314 p…7.8
• CVE-2025-10158A malicious client acting as the receiver of an rsync file t…4.3