deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11380
Published: 2025-10-11
Description: The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3374193%40everest-backup&new=3374193%40everest-backup&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/869d7cab-cf21-4168-b45d-1681c76d896c?source=cve
CVE: CVE-2025-9560
Published: 2025-10-11
Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php; https://wordpress.org/plugins/colibri-page-builder/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve
CVE: CVE-2025-58277
Published: 2025-10-11
Description: Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58278
Published: 2025-10-11
Description: Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58282
Published: 2025-10-11
Description: Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 2.8 (LOW)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58283
Published: 2025-10-11
Description: Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58284
Published: 2025-10-11
Description: Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58285
Published: 2025-10-11
Description: Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-11591
Published: 2025-10-11
Description: A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/actions/delete-member.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/coppeliaz/cve/issues/4; https://vuldb.com/?ctiid.327912
CVE: CVE-2025-11592
Published: 2025-10-11
Description: A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/coppeliaz/cve/issues/5; https://vuldb.com/?ctiid.327913
CVE: CVE-2025-11593
Published: 2025-10-11
Description: A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/coppeliaz/cve/issues/6; https://vuldb.com/?ctiid.327914
CVE: CVE-2025-10048
Published: 2025-10-11
Description: The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3375019/my-auctions-allegro-free-edition; https://www.wordfence.com/threat-intel/vulnerabilities/id/8d81c8d5-3862-4401-9226-9c7380f364a7?source=cve
CVE: CVE-2025-10185
Published: 2025-10-11
Description: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the  'orderby' parameter in the action nf_load_form_entries in all versions up to, and including, 9.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower-level users if access is granted by a site administrator.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.svn.wordpress.org/nex-forms-express-wp-form-builder/tags/9.1.4/includes/classes/class.db.php#2527; https://plugins.trac.wordpress.org/changeset/3365585/nex-forms-express-wp-form-builder/trunk/includes/classes/class.db.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e68d47e7-9a42-4a77-aefa-fe130500cbd3?source=cve
CVE: CVE-2025-11197
Published: 2025-10-11
Description: The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dartiss/draft-list/pull/81/files; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376385%40simple-draft-list&new=3376385%40simple-draft-list&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4711e3d5-b70c-413e-97e7-6d2e93e8217e?source=cve
CVE: CVE-2025-11533
Published: 2025-10-11
Description: The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416; https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve
CVE: CVE-2025-9196
Published: 2025-10-11
Description: The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3373045%40trinity-audio&new=3373045%40trinity-audio&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/64889659-24d6-40d9-97ba-b448f5205a96?source=cve
CVE: CVE-2025-9496
Published: 2025-10-11
Description: The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.6/classes/emr-plugin.php#L645; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371681%40enable-media-replace&new=3371681%40enable-media-replace&sfp_email=&sfph_mail=; https://wordpress.org/plugins/enable-media-replace/
CVE: CVE-2025-11167
Published: 2025-10-11
Description: The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/changeset/3374121/cm-invitation-codes/trunk/controller/LoginController.php?old=3310298&old_path=cm-invitation-codes%2Ftags%2F2.5.5%2Fcontroller%2FLoginController.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c10286fe-2fdf-4946-b7bb-a2b16f93abb0?source=cve
CVE: CVE-2025-11254
Published: 2025-10-11
Description: The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1236
References: https://plugins.trac.wordpress.org/changeset/3375891/contest-gallery/tags/28.0.0/functions/backend/render/cg-backend-gallery-general.php?old=3372123&old_path=contest-gallery%2Ftags%2F27.0.3%2Ffunctions%2Fbackend%2Frender%2Fcg-backend-gallery-general.php; https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/27.0.3&new_path=/contest-gallery/tags/28.0.0&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=cve
CVE: CVE-2025-11518
Published: 2025-10-11
Description: The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3375421%40woo-smart-wishlist&new=3375421%40woo-smart-wishlist&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/afe275b4-edc0-4b19-a91f-5099a085e8ce?source=cve
CVE: CVE-2025-11594
Published: 2025-10-11
Description: A vulnerability has been found in ywxbear PHP-Bookstore-Website-Example and PHP Basic BookStore Website up to 0e0b9f542f7a2d90a8d7f8c83caca69294e234e4. This issue affects some unknown processing of the file /index.php of the component Quantity Handler. Such manipulation leads to improper validation of specified quantity in input. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-703, CWE-1284
References: https://github.com/Lianhaorui/Report/blob/main/Payment%20Logic%20Vulnerability.docx; https://vuldb.com/?ctiid.327915; https://vuldb.com/?id.327915
CVE: CVE-2025-58286
Published: 2025-10-11
Description: Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-25
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58287
Published: 2025-10-11
Description: Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-275, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58288
Published: 2025-10-11
Description: Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-275
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58290
Published: 2025-10-11
Description: Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-41
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58291
Published: 2025-10-11
Description: Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-29
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58292
Published: 2025-10-11
Description: Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-27
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58295
Published: 2025-10-11
Description: Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-121
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58297
Published: 2025-10-11
Description: Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-121
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58298
Published: 2025-10-11
Description: Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58299
Published: 2025-10-11
Description: Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-6553
Published: 2025-10-11
Description: The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579; https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579#item-description__change_log; https://www.wordfence.com/threat-intel/vulnerabilities/id/808392a9-dbac-4896-8677-6ddc1213d80d?source=cve
CVE: CVE-2025-10129
Published: 2025-10-11
Description: The WordPress Live Webcam Widget & Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-webcam-widget-shortcode/trunk/wordpress-webcam.php#L174; https://www.wordfence.com/threat-intel/vulnerabilities/id/edc4875e-3eca-4c25-a65c-93182912cd24?source=cve
CVE: CVE-2025-10167
Published: 2025-10-11
Description: The Stock History & Reports Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_stock_snapshot_restocked shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/stock-snapshot-for-woocommerce/trunk/includes/class-alg-wc-stock-snapshot-shortcodes.php#L174; https://plugins.trac.wordpress.org/changeset/3376453/; https://wordpress.org/plugins/stock-snapshot-for-woocommerce
CVE: CVE-2025-10175
Published: 2025-10-11
Description: The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.svn.wordpress.org/wp-links-page/trunk/wp-links-page-free.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3410752%40wp-links-page&new=3410752%40wp-links-page&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-links-page/
CVE: CVE-2025-10190
Published: 2025-10-11
Description: The WP Easy Toggles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggles' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-easy-toggles/trunk/wp-easy-toggles.php#L31; https://wordpress.org/plugins/wp-easy-toggles; https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9db562-6810-4da1-9e5f-6f6eadca76ac?source=cve
CVE: CVE-2025-10375
Published: 2025-10-11
Description: The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. This makes it possible for unauthenticated attackers to modify plugin settings and create verification files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/accessibe/tags/2.7/class.accessibeforwp.php#L273; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376235%40accessibe&new=3376235%40accessibe&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e3aac40c-1576-45b5-90f8-14ff05c089c7?source=cve
CVE: CVE-2025-10376
Published: 2025-10-11
Description: The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to missing nonce validation when processing form submissions on the settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/course-redirects-for-learndash/trunk/redirect_course.php#L76; https://www.wordfence.com/threat-intel/vulnerabilities/id/f04ef770-73d9-4940-9736-c214bf5137ba?source=cve
CVE: CVE-2025-11595
Published: 2025-10-11
Description: A vulnerability was found in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /admin-profile.php. Performing a manipulation of the argument mobilenumber results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/DavCloudz/cve/issues/6; https://vuldb.com/?ctiid.327916; https://vuldb.com/?id.327916
CVE: CVE-2025-11596
Published: 2025-10-11
Description: A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php. Executing manipulation of the argument order_id can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Blowingwinds/cve-report/blob/main/cve5/report.md; https://vuldb.com/?ctiid.327917
CVE: CVE-2025-58289
Published: 2025-10-11
Description: Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-840, CWE-754
References: https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE: CVE-2025-58293
Published: 2025-10-11
Description: Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/10/