deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12209
Published: 2025-10-27
Description: A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDhcpConfig.md; https://vuldb.com/?ctiid.329879; https://vuldb.com/?id.329879
CVE: CVE-2025-12210
Published: 2025-10-27
Description: A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/AdvSetLanip.md; https://vuldb.com/?ctiid.329880; https://vuldb.com/?id.329880
CVE: CVE-2025-48088
Published: 2025-10-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through < 3.21.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58918
Published: 2025-10-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/WordPress/Theme/entrada/vulnerability/wordpress-entrada-theme-5-7-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-12211
Published: 2025-10-27
Description: A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDmzInfo.md; https://vuldb.com/?ctiid.329881; https://vuldb.com/?id.329881
CVE: CVE-2025-12212
Published: 2025-10-27
Description: A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setNetworkService.md; https://vuldb.com/?ctiid.329882; https://vuldb.com/?id.329882
CVE: CVE-2025-12213
Published: 2025-10-27
Description: A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setVlanConfig.md; https://vuldb.com/?ctiid.329883; https://vuldb.com/?id.329883
CVE: CVE-2025-12214
Published: 2025-10-27
Description: A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing a manipulation of the argument enable results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/sysAutoReboot.md; https://vuldb.com/?ctiid.329884; https://vuldb.com/?id.329884
CVE: CVE-2025-12215
Published: 2025-10-27
Description: A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/juzidddd/SQL-Injection-Vulnerability-in-Projectworlds-PHP-Online-Shopping-System/issues/1; https://vuldb.com/?ctiid.329885; https://vuldb.com/?id.329885
CVE: CVE-2025-12222
Published: 2025-10-27
Description: A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12222.md; https://vuldb.com/?ctiid.329892; https://vuldb.com/?id.329892
CVE: CVE-2025-12223
Published: 2025-10-27
Description: A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12223.md; https://vuldb.com/?ctiid.329893; https://vuldb.com/?id.329893
CVE: CVE-2025-12224
Published: 2025-10-27
Description: A flaw has been found in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This vulnerability affects unknown code of the file admin/contact.php. This manipulation of the argument twitter causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/mhszed/Report/blob/main/php-business-website%20xss.docx; https://vuldb.com/?ctiid.329894; https://vuldb.com/?id.329894
CVE: CVE-2025-12225
Published: 2025-10-27
Description: A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Request Handler. Such manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/WifiGuestSet/WifiGuestSet.md; https://vuldb.com/?ctiid.329895; https://vuldb.com/?id.329895
CVE: CVE-2025-12226
Published: 2025-10-27
Description: A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zhang947/vul/blob/main/report.md; https://vuldb.com/?ctiid.329896; https://vuldb.com/?id.329896
CVE: CVE-2025-11154
Published: 2025-10-27
Description: The IDonate  WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/fdb9e076-4c65-4fd1-b1f6-23c23a11bdb7/
CVE: CVE-2025-12227
Published: 2025-10-27
Description: A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/QIU-DIE/CVE/issues/8; https://vuldb.com/?ctiid.329897; https://vuldb.com/?id.329897
CVE: CVE-2025-12228
Published: 2025-10-27
Description: A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/QIU-DIE/CVE/issues/9; https://vuldb.com/?ctiid.329898; https://vuldb.com/?id.329898
CVE: CVE-2025-12229
Published: 2025-10-27
Description: A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/QIU-DIE/CVE/issues/10; https://vuldb.com/?ctiid.329899; https://vuldb.com/?id.329899
CVE: CVE-2025-12230
Published: 2025-10-27
Description: A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/QIU-DIE/CVE/issues/11; https://vuldb.com/?ctiid.329900; https://vuldb.com/?id.329900
CVE: CVE-2025-12231
Published: 2025-10-27
Description: A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/QIU-DIE/CVE/issues/12; https://vuldb.com/?ctiid.329901; https://vuldb.com/?id.329901
CVE: CVE-2025-12055
Published: 2025-10-27
Description: HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://r.sec-consult.com/mpdv; http://seclists.org/fulldisclosure/2025/Oct/28
CVE: CVE-2025-12232
Published: 2025-10-27
Description: A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/13; https://vuldb.com/?ctiid.329902; https://vuldb.com/?id.329902
CVE: CVE-2025-12233
Published: 2025-10-27
Description: A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/14; https://vuldb.com/?ctiid.329903; https://vuldb.com/?id.329903
CVE: CVE-2025-12234
Published: 2025-10-27
Description: A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/15; https://vuldb.com/?ctiid.329904; https://vuldb.com/?id.329904
CVE: CVE-2025-12235
Published: 2025-10-27
Description: A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/16; https://vuldb.com/?ctiid.329905; https://vuldb.com/?id.329905
CVE: CVE-2025-12236
Published: 2025-10-27
Description: A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/17; https://vuldb.com/?ctiid.329906; https://vuldb.com/?id.329906
CVE: CVE-2025-12237
Published: 2025-10-27
Description: A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulation of the argument keywords leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/juzidddd/Projectworlds-ALMS-SQLi-Vulnerability-Disclosure/issues/1; https://vuldb.com/?ctiid.329907; https://vuldb.com/?id.329907
CVE: CVE-2025-12238
Published: 2025-10-27
Description: A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/xmqaq/cve/issues/8; https://vuldb.com/?ctiid.329908
CVE: CVE-2025-12239
Published: 2025-10-27
Description: A weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Executing manipulation can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setDdnsCfg.md; https://vuldb.com/?ctiid.329909; https://vuldb.com/?id.329909
CVE: CVE-2025-12240
Published: 2025-10-27
Description: A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setDmzCfg.md; https://vuldb.com/?ctiid.329910; https://vuldb.com/?id.329910
CVE: CVE-2025-12241
Published: 2025-10-27
Description: A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. The manipulation of the argument lang results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setLanguageCfg.md; https://vuldb.com/?ctiid.329911; https://vuldb.com/?id.329911
CVE: CVE-2025-12242
Published: 2025-10-27
Description: A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/yihaofuweng/cve/issues/54; https://vuldb.com/?ctiid.329913
CVE: CVE-2025-12243
Published: 2025-10-27
Description: A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/hellonewbie/tutorial/issues/6; https://vuldb.com/?ctiid.329914
CVE: CVE-2025-11682
Published: 2025-10-27
Description: Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4.
CWE: CWE-79, CWE-83
References: https://www.redguard.ch/blog/2025/10/27/advisory-perx-lmt-dashboard/
CVE: CVE-2025-12244
Published: 2025-10-27
Description: A vulnerability was determined in code-projects Simple E-Banking System 1.0. This affects an unknown part of the file /eBank/register.php. Executing manipulation of the argument Username can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/xss5.md; https://vuldb.com/?ctiid.329915
CVE: CVE-2025-12245
Published: 2025-10-27
Description: A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345, CWE-346
References: https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/; https://vuldb.com/?ctiid.329916; https://vuldb.com/?id.329916
CVE: CVE-2025-12246
Published: 2025-10-27
Description: A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/; https://vuldb.com/?ctiid.329917; https://vuldb.com/?id.329917
CVE: CVE-2025-12247
Published: 2025-10-27
Description: A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-428
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/Halseo%20Backupservice.md; https://github.com/lakshayyverma/CVE-Discovery/blob/main/Hasleo%20Backup%20Suite%20ImageMountService.md; https://vuldb.com/?ctiid.329918
CVE: CVE-2025-12248
Published: 2025-10-27
Description: A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the argument keyword leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/1276486/CVE/issues/17; https://vuldb.com/?ctiid.329919; https://vuldb.com/?id.329919
CVE: CVE-2025-12249
Published: 2025-10-27
Description: A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-1236
References: https://drive.google.com/file/d/1EtmG4IyNQO7VStycpkSl9iivURrYQBSD/view?usp=sharing; https://vuldb.com/?ctiid.329920; https://vuldb.com/?id.329920
CVE: CVE-2025-12080
Published: 2025-10-27
Description: On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented.

Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device.
CWE: CWE-345
References: https://towerofhanoi.it/writeups/cve-2025-12080/