deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53397
Published: 2025-07-11
Description: A vulnerability exists in Advantech iView versions prior to 5.7.05 build
 7057, which could allow a reflected cross-site scripting (XSS) attack. 
By exploiting this flaw, an attacker could execute unauthorized scripts 
in the user's browser, potentially leading to information disclosure or 
other malicious activities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183; https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08
CVE: CVE-2025-53471
Published: 2025-07-11
Description: Emerson ValveLink products 
receive input or data, but it do not validate or incorrectly 
validates that the input has the properties that are required to process
 the data safely and correctly.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01; https://www.emerson.com/en-us/support/security-notifications; https://www.emerson.com/en-us/support/software-downloads-drivers
CVE: CVE-2025-53475
Published: 2025-07-11
Description: A vulnerability exists in Advantech iView that could allow for SQL 
injection and remote code execution through 
NetworkServlet.getNextTrapPage(). This issue requires an authenticated 
attacker with at least user-level privileges. Certain parameters in this
 function are not properly sanitized, allowing an attacker to perform 
SQL injection and potentially execute code in the context of the 'nt 
authority\local service' account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183; https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08
CVE: CVE-2025-53509
Published: 2025-07-11
Description: A vulnerability exists in Advantech iView that allows for argument 
injection in the NetworkServlet.restoreDatabase(). This issue requires 
an authenticated attacker with at least user-level privileges. An input 
parameter can be used directly in a command without proper sanitization,
 allowing arbitrary arguments to be injected. This can result in 
information disclosure, including sensitive database credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-88
References: https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183; https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08
CVE: CVE-2025-53515
Published: 2025-07-11
Description: A vulnerability exists in Advantech iView that allows for SQL injection 
and remote code execution through NetworkServlet.archiveTrap(). This 
issue requires an authenticated attacker with at least user-level 
privileges. Certain input parameters are not sanitized, allowing an 
attacker to perform SQL injection and potentially execute code in the 
context of the 'nt authority\local service' account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183; https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08
CVE: CVE-2025-53519
Published: 2025-07-11
Description: A vulnerability exists in Advantech iView versions prior to 5.7.05 build
 7057, which could allow a reflected cross-site scripting (XSS) attack. 
By manipulating specific parameters, an attacker could execute 
unauthorized scripts in the user's browser, potentially leading to 
information disclosure or other malicious activities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183; https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08
CVE: CVE-2025-7420
Published: 2025-07-11
Description: A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been declared as critical. This vulnerability affects the function formWifiBasicSet of the file /goform/setWrlBasicInfo of the component httpd. The manipulation of the argument extChannel leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_53/53.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_53/53.md#poc; https://vuldb.com/?ctiid.315880
CVE: CVE-2025-5241
Published: 2025-07-11
Description: Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-645
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-184-04; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-005_en.pdf
CVE: CVE-2025-7421
Published: 2025-07-11
Description: A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/operateMacFilter of the component httpd. The manipulation of the argument mac leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_54/54.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_54/54.md#poc; https://vuldb.com/?ctiid.315881
CVE: CVE-2025-7422
Published: 2025-07-11
Description: A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /goform/setNetworkService of the component httpd. The manipulation of the argument week leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_55/55.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_55/55.md#poc; https://vuldb.com/?ctiid.315882
CVE: CVE-2025-7423
Published: 2025-07-11
Description: A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). Affected by this vulnerability is the function formWifiMacFilterSet of the file /goform/setWrlFilterList of the component httpd. The manipulation of the argument macList leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_56/56.md; https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_56/56.md#poc; https://vuldb.com/?ctiid.315883
CVE: CVE-2025-7434
Published: 2025-07-11
Description: A vulnerability was found in Tenda FH451 up to 1.0.0.9 and classified as critical. Affected by this issue is the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/zezhifu1/cve_report/blob/main/FH451/fromAddressNat.md; https://github.com/zezhifu1/cve_report/blob/main/FH451/fromAddressNat.md#payload; https://vuldb.com/?ctiid.316004
CVE: CVE-2025-53864
Published: 2025-07-11
Description: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-674
References: https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c; https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested; https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch
CVE: CVE-2025-7435
Published: 2025-07-11
Description: A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 542aa8449b5aa889b3a54f419e794afe19f56d5d/0ce7b4f1193c0ed6c6e31a960fafededf979eef2. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/CodeBrics/lhc-php-resque-exploit/; https://github.com/CodeBrics/lhc-php-resque-exploit/?tab=readme-ov-file#attack-vector; https://github.com/LiveHelperChat/lhc-php-resque/commit/542aa8449b5aa889b3a54f419e794afe19f56d5d
CVE: CVE-2025-7436
Published: 2025-07-11
Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_vacancy. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/newb001/CVE/issues/1; https://vuldb.com/?ctiid.316006; https://vuldb.com/?id.316006
CVE: CVE-2025-7401
Published: 2025-07-11
Description: The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remote_tunnel.php in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server which may make the exposure of sensitive information or remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://codecanyon.net/item/premium-age-verification-restriction-for-wordpress/11300327; https://www.wordfence.com/threat-intel/vulnerabilities/id/e0906a45-6d9b-48a0-98ae-df7b591a8848?source=cve
CVE: CVE-2025-2942
Published: 2025-07-11
Description: The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/; https://wpscan.com/vulnerability/13a87567-2cf7-4bfb-8d63-a8e74950978f/
CVE: CVE-2025-30023
Published: 2025-07-11
Description: The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://www.axis.com/dam/public/9b/a5/72/cve-2025-30023pdf-en-US-485733.pdf
CVE: CVE-2025-30024
Published: 2025-07-11
Description: The communication protocol used between client
and server had a flaw that could be leveraged to execute a man in the middle attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://www.axis.com/dam/public/01/d9/24/cve-2025-30024pdf-en-US-485734.pdf
CVE: CVE-2025-30025
Published: 2025-07-11
Description: The communication protocol used between the
server process and the service control had a flaw that could lead to a local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.axis.com/dam/public/f2/28/d2/cve-2025-30025pdf-en-US-517962.pdf
CVE: CVE-2025-30026
Published: 2025-07-11
Description: The AXIS Camera Station Server had a flaw that allowed
to bypass authentication that is normally required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://www.axis.com/dam/public/a3/42/92/cve-2025-30026pdf-en-US-485735.pdf
CVE: CVE-2025-6200
Published: 2025-07-11
Description: The GeoDirectory  WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/27c35255-4963-4d93-85e7-9e7688e5eb2e/
CVE: CVE-2025-5028
Published: 2025-07-11
Description: Installation file of ESET security products on Windows 

allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.
CWE: CWE-269
References: https://support.eset.com/en/ca8838-arbitrary-file-deletion-vulnerability-in-eset-product-installers-on-windows-fixed
CVE: CVE-2025-5392
Published: 2025-07-11
Description: The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L334; https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L367; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323703%40gb-forms-db&new=3323703%40gb-forms-db&sfp_email=&sfph_mail=
CVE: CVE-2025-5992
Published: 2025-07-11
Description: When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.
CWE: CWE-20
References: https://codereview.qt-project.org/c/qt/qtbase/+/647919
CVE: CVE-2025-6716
Published: 2025-07-11
Description: The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload[1][title]' parameter in all versions up to, and including, 26.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3321912%40contest-gallery&new=3321912%40contest-gallery&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e54caaf5-f37b-4842-ab3d-8e37cbed58da?source=cve
CVE: CVE-2025-4593
Published: 2025-07-11
Description: The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'rp_user_data' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from user meta like hashed passwords, usernames, and more.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3324309%40wp-register-profile-with-shortcode&new=3324309%40wp-register-profile-with-shortcode&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae7f5e3-7312-4fee-962b-3aecd8432557?source=cve
CVE: CVE-2025-5530
Published: 2025-07-11
Description: The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L187; https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L2616; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318565%40woo-smart-compare&new=3318565%40woo-smart-compare&sfp_email=&sfph_mail=
CVE: CVE-2025-6068
Published: 2025-07-11
Description: The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/foogallery/trunk/extensions/default-templates/shared/js/foogallery.min.js; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3322251%40foogallery&new=3322251%40foogallery&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a6be4aaa-f8a1-42d6-95c1-062c5ca51004?source=cve
CVE: CVE-2025-6745
Published: 2025-07-11
Description: The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492; https://www.wordfence.com/threat-intel/vulnerabilities/id/3408895e-3418-4f70-8b7c-76f6ba899d11?source=cve
CVE: CVE-2025-7442
Published: 2025-07-11
Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964?s_rank=2; https://www.wordfence.com/threat-intel/vulnerabilities/id/e52289fe-9a38-4ebf-b24a-034768fa56b7?source=cve
CVE: CVE-2025-6438
Published: 2025-07-11
Description: A







CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access
when the server is accessed via the network using an application account.
CWE: CWE-611
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf; http://seclists.org/fulldisclosure/2025/Jul/5
CVE: CVE-2025-6838
Published: 2025-07-11
Description: The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-1236
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323864%40broken-link-notifier&new=3323864%40broken-link-notifier&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd96beee-afcb-4439-ad9b-f24e8afeac3c?source=cve
CVE: CVE-2025-6851
Published: 2025-07-11
Description: The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323864%40broken-link-notifier&new=3323864%40broken-link-notifier&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f76c9f8-c57a-4875-b581-f67c9c60021c?source=cve
CVE: CVE-2025-3933
Published: 2025-07-11
Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93; https://huntr.com/bounties/[PII_REDACTED]-bb6f-5790d275721b
CVE: CVE-2025-50121
Published: 2025-07-11
Description: A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created
over the web interface HTTP when enabled. HTTP is disabled by default.
CWE: CWE-78
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf; http://seclists.org/fulldisclosure/2025/Jul/6
CVE: CVE-2025-50122
Published: 2025-07-11
Description: A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the
password generation algorithm is reverse engineered with access to installation or upgrade artifacts.
CWE: CWE-331
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf; http://seclists.org/fulldisclosure/2025/Jul/7