deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-41255
Published: 2025-06-25
Description: Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions.











This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.
CVSS Score: 8.0 (HIGH)
CWE: CWE-266
References: https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-vjjc-grpp-m655; https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-01_Cyberduck_Mountain_Duck_Certificate_Handling; https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-vjjc-grpp-m655
CVE: CVE-2025-41256
Published: 2025-06-25
Description: Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak.







This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5.
CVSS Score: 7.4 (HIGH)
CWE: CWE-328
References: https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-688c-vjrc-84rv; https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-02_Cyberduck_Mountain_Duck_Weak_Hash; https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-688c-vjrc-84rv
CVE: CVE-2025-41647
Published: 2025-06-25
Description: A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://certvde.com/en/advisories/VDE-2025-043/
CVE: CVE-2025-49797
Published: 2025-06-25
Description: Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS Score: 7.8 (HIGH)
CWE: CWE-552
References: https://jvn.jp/en/vu/JVNVU91819309/; https://support.brother.com/g/s/security/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000009
CVE: CVE-2025-5927
Published: 2025-06-25
Description: The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.
CVSS Score: 7.5 (HIGH)
CWE: CWE-36
References: https://everestforms.net/changelog/; https://wordpress.org/plugins/everest-forms/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3a118f-4321-4579-a986-05ce077dc6b9?source=cve
CVE: CVE-2025-6613
Published: 2025-06-25
Description: A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of the file /doctor/manage-patient.php. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Vanshdhawan188/Stored-XSS-Hospital-Management/blob/main/Stored-XSS-Hospital-Management.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.313831
CVE: CVE-2025-6603
Published: 2025-06-25
Description: A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc[PII_REDACTED]e. It has been rated as problematic. Affected by this issue is the function qcow_make_empty of the file qCUDA/qcu-device/block/qcow.c. The manipulation of the argument s->l1_size leads to integer overflow. The attack needs to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-189, CWE-190
References: https://github.com/coldfunction/qCUDA/issues/10; https://vuldb.com/?ctiid.313820; https://vuldb.com/?id.313820
CVE: CVE-2025-25012
Published: 2025-06-25
Description: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444
CVE: CVE-2025-6543
Published: 2025-06-25
Description: Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543
CVE: CVE-2025-6604
Published: 2025-06-25
Description: A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add-staff.php. The manipulation of the argument Name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-5.md; https://vuldb.com/?ctiid.313821; https://vuldb.com/?id.313821
CVE: CVE-2025-48954
Published: 2025-06-25
Description: Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf
CVE: CVE-2025-48991
Published: 2025-06-25
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99[PII_REDACTED] and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99[PII_REDACTED], Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/cbf9b2a38e33dfd755dc2ccf074126b598a78274; https://github.com/Enalean/tuleap/security/advisories/GHSA-px9r-875r-w534; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=cbf9b2a38e33dfd755dc2ccf074126b598a78274
CVE: CVE-2025-6605
Published: 2025-06-25
Description: A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown code of the file /panel/edit-staff.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-6.md; https://vuldb.com/?ctiid.313822; https://vuldb.com/?id.313822
CVE: CVE-2025-6606
Published: 2025-06-25
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. This issue affects some unknown processing of the file /panel/add-services.php. The manipulation of the argument Type leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-7.md; https://vuldb.com/?ctiid.313823; https://vuldb.com/?id.313823
CVE: CVE-2025-6607
Published: 2025-06-25
Description: A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/stock.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-8.md; https://vuldb.com/?ctiid.313824; https://vuldb.com/?id.313824
CVE: CVE-2021-4457
Published: 2025-06-25
Description: The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad
CVE: CVE-2024-27685
Published: 2025-06-25
Description: SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload to the $cshortname, $cfullname, and $cdate variables.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://medium.com/@cnetsec/a-sql-injection-vulnerability-exists-in-the-student-record-system-using-php-and-mysql-v3-20-df2c6fe7dc15; https://phpgurukul.com/student-record-system-php/
CVE: CVE-2025-49135
Published: 2025-06-25
Description: CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a `user` role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files.  This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/cvat-ai/cvat/commit/dbafd9c0287489bea00e1db626f64b107f90bfc9; https://github.com/cvat-ai/cvat/security/advisories/GHSA-frpr-5w6q-hh4f
CVE: CVE-2025-6608
Published: 2025-06-25
Description: A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /panel/edit-services.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-9.md; https://vuldb.com/?ctiid.313825; https://vuldb.com/?id.313825
CVE: CVE-2025-6609
Published: 2025-06-25
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /panel/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-10.md; https://vuldb.com/?ctiid.313826; https://vuldb.com/?id.313826
CVE: CVE-2025-6610
Published: 2025-06-25
Description: A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/editempprofile.php. The manipulation of the argument FirstName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Sp1d3rL1/CVE/issues/5; https://itsourcecode.com/; https://vuldb.com/?ctiid.313827
CVE: CVE-2024-57708
Published: 2025-06-25
Description: An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-471, CWE-915, CWE-1321
References: https://discord.com/assets/oneTrust/v4/scripttemplates/6.33.0/otBannerSdk.js; https://github.com/brotheralameen1/Discordforschool/security/advisories/GHSA-63xr-98vc-whx5; https://packetstorm.news/files/id/201222/
CVE: CVE-2025-20264
Published: 2025-06-25
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions.

This vulnerability is due to insufficient authorization enforcement mechanisms for users created by SAML SSO integration with an external identity provider. An attacker could exploit this vulnerability by submitting a series of specific commands to an affected device. A successful exploit could allow the attacker to modify a limited number of system settings, including some that would result in a system restart. In single-node Cisco ISE deployments, devices that are not authenticated to the network will not be able to authenticate until the Cisco ISE system comes back online.&nbsp;
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-285
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-mVfKVQAU
CVE: CVE-2025-20281
Published: 2025-06-25
Description: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281; https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability
CVE: CVE-2025-25905
Published: 2025-06-25
Description: Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://4pace.com/en/products/cadclick; https://medium.com/@mdjab3r/cve-2025-25905-ffff82c635f2; https://support.cadclick.com
CVE: CVE-2025-44206
Published: 2025-06-25
Description: Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2402 are vulnerable to Cross Site Scripting (XSS) which allows a remote authenticated attacker with access to the Broadcast (Person) functionality to execute arbitrary code.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/yuxuannn/cve-details/blob/main/CVE-2025-44206.md; https://hexagon.com/products/hxgn-oncall-dispatch/
CVE: CVE-2025-49845
Published: 2025-06-25
Description: Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been discovered that users of versions prior to 3.4.6 on the `stable` branch and prior to 3.5.0.beta8-dev on the `tests-passed` branch can continue to see their own whispers even after losing visibility of posts typed `whisper`. This issue is patched in versions 3.4.6 and 3.5.0.beta8-dev. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-79qw-r73r-69gf
CVE: CVE-2025-50178
Published: 2025-06-25
Description: GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functions. In the `GitForge.get_repo` function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like `../` in the input to access any other endpoints on api.github.com that were not intended. Version 0.4.3 contains a patch for the issue. No known workarounds are available.
CWE: CWE-20, CWE-22
References: https://github.com/JuliaWeb/GitForge.jl/pull/50; https://github.com/JuliaWeb/GitForge.jl/security/advisories/GHSA-g2xx-229f-3qjm
CVE: CVE-2025-50179
Published: 2025-06-25
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99[PII_REDACTED] and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99[PII_REDACTED] and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/0f9aab6e3640e892c74c9dfc90ad65fd3aff499e; https://github.com/Enalean/tuleap/security/advisories/GHSA-rxpm-g7gw-4mrv; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0f9aab6e3640e892c74c9dfc90ad65fd3aff499e
CVE: CVE-2025-52479
Published: 2025-06-25
Description: HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, this can lead to a CRLF injection attack. Users of HTTP.jl should upgrade immediately to HTTP.jl v1.10.17, and users of URIs.jl should upgrade immediately to URIs.jl v1.6.0. The check for valid URIs is now in the URI.jl package, and the latest version of HTTP.jl incorporates that fix. As a workaround, manually validate any URIs before passing them on to functions in this package.
CWE: CWE-93, CWE-113
References: https://github.com/JuliaWeb/HTTP.jl/commit/e124953f388e7750f893fcf90efc72b7a59e35eb; https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-4g68-4pxg-mw93; https://github.com/JuliaWeb/URIs.jl/pull/66
CVE: CVE-2025-6611
Published: 2025-06-25
Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/createBrand.php. The manipulation of the argument brandStatus leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Lwlej/cve/issues/2; https://vuldb.com/?ctiid.313828
CVE: CVE-2025-6612
Published: 2025-06-25
Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/removeCategories.php. The manipulation of the argument categoriesId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Lwlej/cve/issues/1; https://vuldb.com/?ctiid.313829
CVE: CVE-2025-6614
Published: 2025-06-25
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of the file /goform/formSetWANType_Wizard5. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_75/75.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_75/75.md#poc; https://vuldb.com/?ctiid.313832
CVE: CVE-2025-6615
Published: 2025-06-25
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform/formAutoDetecWAN_wizard4. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_76/76.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_76/76.md#poc; https://vuldb.com/?ctiid.313833
CVE: CVE-2023-44915
Published: 2025-06-25
Description: A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: http://c3crm.com; https://github.com/dfar2008/c3crm; https://github.com/dfar2008/c3crm/tree/master/Login.php#L108
CVE: CVE-2025-20282
Published: 2025-06-25
Description: A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.

This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-269
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
CVE: CVE-2025-49151
Published: 2025-06-25
Description: The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication.
CWE: CWE-547
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-07
CVE: CVE-2025-49152
Published: 2025-06-25
Description: The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.
CWE: CWE-613
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-07