deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11660
Published: 2025-10-13
Description: A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. Such manipulation of the argument File leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/qqy-123/cve/issues/5; https://vuldb.com/?ctiid.328077; https://vuldb.com/?id.328077
CVE: CVE-2025-31994
Published: 2025-10-13
Description: HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124472
CVE: CVE-2025-31996
Published: 2025-10-13
Description: HCL Unica Platform is affected by unprotected files due to improper access controls.   These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124418
CVE: CVE-2025-11661
Published: 2025-10-13
Description: A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-306, CWE-306
References: https://github.com/qqy-123/cve/issues/6; https://vuldb.com/?ctiid.328078; https://vuldb.com/?id.328078
CVE: CVE-2025-11662
Published: 2025-10-13
Description: A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulation of the argument serv_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Scorbunny2/Best-salon-management-system-SQL-injection; https://vuldb.com/?ctiid.328081; https://vuldb.com/?id.328081
CVE: CVE-2025-31995
Published: 2025-10-13
Description: HCL Unica MaxAI Workbench is vulnerable to improper input validation.  This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124425
CVE: CVE-2025-11663
Published: 2025-10-13
Description: A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. This manipulation of the argument sername causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-79
References: https://github.com/HYLCXH/CVE/issues/12; https://vuldb.com/?ctiid.328082; https://vuldb.com/?id.328082
CVE: CVE-2025-9698
Published: 2025-10-13
Description: The Plus Addons for Elementor  WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
CVSS Score: 6.8 (MEDIUM)
References: https://wpscan.com/vulnerability/a9539def-d92b-4117-b36a-17015c578d89/
CVE: CVE-2025-0636
Published: 2025-10-13
Description: EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://www.ericsson.com/en/about-us/security/psirt/cve-2025-0636
CVE: CVE-2025-11664
Published: 2025-10-13
Description: A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /admin/search-appointment.php. Such manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/HYLCXH/CVE/issues/13; https://vuldb.com/?ctiid.328083; https://vuldb.com/?id.328083
CVE: CVE-2025-11665
Published: 2025-10-13
Description: A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695.md; https://vuldb.com/?ctiid.328084; https://vuldb.com/?id.328084
CVE: CVE-2025-11666
Published: 2025-10-13
Description: A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-255, CWE-259
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/RP3.md; https://vuldb.com/?ctiid.328085; https://vuldb.com/?id.328085
CVE: CVE-2025-27258
Published: 2025-10-13
Description: Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-enm-october-2025
CVE: CVE-2025-27259
Published: 2025-10-13
Description: Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-enm-october-2025
CVE: CVE-2025-8915
Published: 2025-10-13
Description: Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network
CWE: CWE-200
References: https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/
CVE: CVE-2025-9265
Published: 2025-10-13
Description: A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects 

 Kiloview NDI N30

and was fixed in Firmware version later than  2.02.0246
CWE: CWE-287, CWE-290, CWE-346
References: https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/
CVE: CVE-2025-10552
Published: 2025-10-13
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10552
CVE: CVE-2025-10556
Published: 2025-10-13
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10556
CVE: CVE-2025-10557
Published: 2025-10-13
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10557
CVE: CVE-2025-10558
Published: 2025-10-13
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10558
CVE: CVE-2025-11667
Published: 2025-10-13
Description: A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candidate_modal.php.. The manipulation of the argument firstname results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/daminqaq/damin-CVE/issues/1; https://vuldb.com/?ctiid.328087
CVE: CVE-2025-11668
Published: 2025-10-13
Description: A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_user.php. This manipulation of the argument Password causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/xmqaq/cve/issues/7; https://vuldb.com/?ctiid.328088
CVE: CVE-2025-11671
Published: 2025-10-13
Description: Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain information such as account names and IP addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.twcert.org.tw/en/cp-139-10420-d1a4f-2.html; https://www.twcert.org.tw/tw/cp-132-10419-de614-1.html
CVE: CVE-2025-11672
Published: 2025-10-13
Description: Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain user group names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.twcert.org.tw/en/cp-139-10420-d1a4f-2.html; https://www.twcert.org.tw/tw/cp-132-10419-de614-1.html
CVE: CVE-2025-11673
Published: 2025-10-13
Description: SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arbitrary code on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-912
References: https://www.twcert.org.tw/en/cp-139-10422-e06c3-2.html; https://www.twcert.org.tw/tw/cp-132-10421-5cf6b-1.html
CVE: CVE-2025-11674
Published: 2025-10-13
Description: SOOP-CLM developed by PiExtract has a Server-Side Request Forgery vulnerability, allowing privileged remote attackers to read server files or probe internal network information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: https://www.twcert.org.tw/en/cp-139-10422-e06c3-2.html; https://www.twcert.org.tw/tw/cp-132-10421-5cf6b-1.html
CVE: CVE-2025-11675
Published: 2025-10-13
Description: Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-10424-4e42c-2.html; https://www.twcert.org.tw/tw/cp-132-10423-a3861-1.html
CVE: CVE-2025-9976
Published: 2025-10-13
Description: An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976
CVE: CVE-2025-9968
Published: 2025-10-13
Description: A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation.
For more information, please refer to section 'Security Update for Armoury Crate App' in the ASUS Security Advisory.
CWE: CWE-59
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-10720
Published: 2025-10-13
Description: The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/5295e8da-7aba-4322-981b-80d692b3bc35/
CVE: CVE-2025-11183
Published: 2025-10-13
Description: Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14
allows an authorized attacker to plant arbitrary JavaScript code in the page
CWE: CWE-79
References: https://hub.ntc.swiss/ntcf-2025-4286
CVE: CVE-2025-11184
Published: 2025-10-13
Description: Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31
allows an authorized attacker to plant arbitrary JavaScript code in the page
CWE: CWE-79
References: https://hub.ntc.swiss/ntcf-2025-7724
CVE: CVE-2025-9336
Published: 2025-10-13
Description: A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution. 
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CWE: CWE-121
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-9337
Published: 2025-10-13
Description: A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD).
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CWE: CWE-476
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-6919
Published: 2025-10-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection.This issue affects Aykome License Tracking System: before Version dated 06.10.2025.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0332
CVE: CVE-2025-9902
Published: 2025-10-13
Description: Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse.This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0333
CVE: CVE-2025-37729
Published: 2025-10-13
Description: Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1336
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641
CVE: CVE-2025-39964
Published: 2025-10-13
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion.  Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.

Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285; https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
CVE: CVE-2025-39965
Published: 2025-10-13
Description: In the Linux kernel, the following vulnerability has been resolved:

xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

x->id.spi == 0 means "no SPI assigned", but since commit
94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states
and add them to the byspi list with this value.

__xfrm_state_delete doesn't remove those states from the byspi list,
since they shouldn't be there, and this shows up as a UAF the next
time we go through the byspi list.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0baf92d0b1590b903c1f4ead75e61715e50e8146; https://git.kernel.org/stable/c/9fcedabaae0096f712bbb4ccca6a8538af1cd1c8; https://git.kernel.org/stable/c/a78e[PII_REDACTED]3c446f18d5002a8de4b09e6bf7
CVE: CVE-2025-43991
Published: 2025-10-13
Description: SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system could potentially exploit this vulnerability to delete arbitrary files only in that affected system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-61
References: https://www.dell.com/support/kbdoc/en-us/000378367/dsa-2025-362-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE: CVE-2025-11695
Published: 2025-10-13
Description: When tlsInsecure=False appears in a connection string, certificate validation is disabled.

This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5
CVSS Score: 8.0 (HIGH)
CWE: CWE-295
References: https://jira.mongodb.org/browse/RUST-2264
CVE: CVE-2025-62244
Published: 2025-10-13
Description: Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62244
CVE: CVE-2025-7707
Published: 2025-10-13
Description: The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-377
References: https://github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4; https://huntr.com/bounties/3fe2c8ab-6727-4aef-a0ef-4d2818e48803
CVE: CVE-2025-61775
Published: 2025-10-13
Description: Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address could receive repeated confirmation messages if the verification link was accessed multiple times. This issue may result in unintended email traffic but does not expose user data. The issue was addressed in version 2025.10.0 by improving validation logic to ensure verification links behave as expected after completion.
CWE: CWE-613, CWE-770
References: https://github.com/Whimsies-YAT/Vickey/security/advisories/GHSA-q6hp-37x8-fhm7
CVE: CVE-2025-62170
Published: 2025-10-13
Description: rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/rathena/rathena/commit/af2f3ba33fc03dc6dd510f8cfe84cd9185af748d; https://github.com/rathena/rathena/security/advisories/GHSA-9mj9-8vgv-r92j
CVE: CVE-2025-62243
Published: 2025-10-13
Description: Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter.

Publications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62243
CVE: CVE-2025-58084
Published: 2025-10-13
Description: Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-62241
Published: 2025-10-13
Description: Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62241