CVE-2025-5265

Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

• CWE-77

• https://bugzilla.mozilla.org/show_bug.cgi?id=1962301Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-42/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-43/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-44/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-45/
• https://www.mozilla.org/security/advisories/mfsa2025-46/

Published

May 27, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52644HCL AION is affected by a vulnerability where certain user a…8.2
• CVE-2025-52645HCL AION is affected by a vulnerability where model packagin…5.3
• CVE-2025-52646HCL AION is affected by a vulnerability where certain offeri…5.3
• CVE-2025-52647The BigFix WebUI application responds with HOST information …6.1
• CVE-2025-52648HCL AION is affected by a vulnerability where offering image…9.8
• CVE-2025-52649HCL AION is affected by a vulnerability where certain identi…5.3
• CVE-2025-52650Inline script execution allowed in CSP vulnerability has bee…6.1
• CVE-2025-52653HCL MyXalytics product is affected by Cross Site Scripting v…5.4
• CVE-2025-52654HCL MyXalytics v6.6 is affected by an HTML Injection. This i…4.6
• CVE-2025-52655Inclusion of Functionality from Untrusted Control Sphere vul…3.1
• CVE-2025-52656HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnera…7.6
• CVE-2025-52658HCL MyXalytics is affected by the use of vulnerable/outdated…4.8