deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-65516
Published: 2025-12-04
Description: A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/x0root/e5597622fede55b320d29a248dce01e6; https://manual.seafile.com/latest/changelog/server-changelog/
CVE: CVE-2025-8074
Published: 2025-12-04
Description: Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-346
References: https://www.synology.com/en-global/security/advisory/Synology_SA_25_09
CVE: CVE-2025-63364
Published: 2025-12-04
Description: Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07[PII_REDACTED] was discovered to transmit Administrator credentials in plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://drive.google.com/file/d/1AGv9KWMTB71NJfIOncuNO6FyK0UAqxmL/view?usp=sharing; https://otsecverse.github.io/OTSecVerse/posts/Post-4/
CVE: CVE-2025-66287
Published: 2025-12-04
Description: A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://access.redhat.com/errata/RHSA-2025:22789; https://access.redhat.com/errata/RHSA-2025:22790; https://access.redhat.com/errata/RHSA-2025:23110
CVE: CVE-2025-66373
Published: 2025-12-04
Description: Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-444
References: https://en.wikipedia.org/wiki/HTTP_request_smuggling; https://www.akamai.com/blog/security/cve-2025-66373-http-request-smuggling-chunked-body-size
CVE: CVE-2025-66516
Published: 2025-12-04
Description: Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. 

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. 

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. 

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
CVSS Score: 8.4 (HIGH)
CWE: CWE-611
References: https://cve.org/CVERecord?id=CVE-2025-54988; https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k
CVE: CVE-2025-14011
Published: 2025-12-04
Description: A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component Add Display Name Field. Performing a manipulation of the argument aid/tid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/24-2021/vul2/blob/main/jizhicms%3DV2.5.5-addcomment.html-aid%20parameter-SQL%20injection/jizhicms-addcomment.html-aid%20parameter-SQL%20injection.md; https://vuldb.com/?ctiid.334252; https://vuldb.com/?id.334252
CVE: CVE-2025-14012
Published: 2025-12-04
Description: A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/deleteAll.html of the component Batch Delete Comments. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/24-2021/vul2/blob/main/jizhicms%3DV2.5.5-deleteAll.html-data%20parameter-SQL%20injection/jizhicms%3DV2.5.5-deleteAll.html-data%20parameter-SQL%20injection.md; https://vuldb.com/?ctiid.334253; https://vuldb.com/?id.334253
CVE: CVE-2025-63363
Published: 2025-12-04
Description: A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07[PII_REDACTED] allows attackers to execute de-authentication attacks, allowing crafted deauthentication and disassociation frames to be broadcast without authentication or encryption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-300
References: https://drive.google.com/file/d/1AGv9KWMTB71NJfIOncuNO6FyK0UAqxmL/view?usp=sharing; https://otsecverse.github.io/OTSecVerse/posts/Post-3/
CVE: CVE-2025-9127
Published: 2025-12-04
Description: A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-116
References: https://support.purestorage.com/category/m_pure_storage_product_security
CVE: CVE-2025-13488
Published: 2025-12-04
Description: Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.
CWE: CWE-79
References: https://help.sonatype.com/en/sonatype-nexus-repository-3-87-0-release-notes.html; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]8019
CVE: CVE-2025-14013
Published: 2025-12-04
Description: A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of the component Comment Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/24-2021/vul2/blob/main/jizhicms%3DV2.5.5-Commentaddcomment.html-bodyparameter-Storage%20XSS/jizhicms%3DV2.5.5-Commentaddcomment.html-bodyparameter-Storage%20XSS.md; https://vuldb.com/?ctiid.334254; https://vuldb.com/?id.334254
CVE: CVE-2025-14015
Published: 2025-12-04
Description: A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/HungryGoogle/log_attack/blob/main/index2/2.md; https://vuldb.com/?ctiid.334256; https://vuldb.com/?id.334256
CVE: CVE-2025-14016
Published: 2025-12-04
Description: A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-863
References: https://github.com/Hwwg/cve/issues/17; https://vuldb.com/?ctiid.334257; https://vuldb.com/?id.334257
CVE: CVE-2025-59788
Published: 2025-12-04
Description: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-749, CWE-79
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r; https://nextcloud.com; https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/
CVE: CVE-2025-63361
Published: 2025-12-04
Description: Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07[PII_REDACTED] was discovered to render the Administrator password in plaintext.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-522
References: https://drive.google.com/file/d/1AGv9KWMTB71NJfIOncuNO6FyK0UAqxmL/view?usp=sharing; https://otsecverse.github.io/OTSecVerse/posts/Post-1/
CVE: CVE-2025-63362
Published: 2025-12-04
Description: Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07[PII_REDACTED] allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620
References: https://drive.google.com/file/d/1AGv9KWMTB71NJfIOncuNO6FyK0UAqxmL/view?usp=sharing; https://otsecverse.github.io/OTSecVerse/posts/Post-2/
CVE: CVE-2025-65637
Published: 2025-12-04
Description: A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/mjuanxd/logrus-dos-poc; https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md; https://github.com/sirupsen/logrus/issues/1370
CVE: CVE-2025-65945
Published: 2025-12-04
Description: auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e; https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
CVE: CVE-2025-12097
Published: 2025-12-04
Description: There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.  Successful exploitation requires an attacker to send a specially crafted request to the NI System Web Server, allowing the attacker to read arbitrary files.  This vulnerability existed in the NI System Web Server 2012 and prior versions.  It was fixed in 2013.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/relative-path-traversal-vulnerability-in-ni-system-web-server.html
CVE: CVE-2025-12994
Published: 2025-12-04
Description: Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html
CVE: CVE-2025-12995
Published: 2025-12-04
Description: Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html
CVE: CVE-2025-12996
Published: 2025-12-04
Description: Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-532
References: https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html
CVE: CVE-2025-12997
Published: 2025-12-04
Description: Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.
CVSS Score: 2.2 (LOW)
CWE: CWE-639
References: https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html
CVE: CVE-2025-29268
Published: 2025-12-04
Description: ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://all-rut22gw.com; http://allnet.com; https://blog.byteray.co.uk/critical-vulnerabilities-in-rut22gw-industrial-lte-cellular-routers-f4eb8768feb7?gi=f74ff4eb9f22
CVE: CVE-2025-29269
Published: 2025-12-04
Description: ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://all-rut22gw.com; http://allnet.com; https://blog.byteray.co.uk/critical-vulnerabilities-in-rut22gw-industrial-lte-cellular-routers-f4eb8768feb7?gi=f74ff4eb9f22
CVE: CVE-2025-63499
Published: 2025-12-04
Description: Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://email.example.com/SOGo/so/victim@example.com/Mail/view?theme=%27%3CScRiPt%20%3Ealert%289998%29%3C%2FScRiPt%3E; https://github.com/poblaguev-tot/CVE-2025-63499; https://github.com/poblaguev-tot/CVE-2025-63499
CVE: CVE-2025-65806
Published: 2025-12-04
Description: The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP containing another ZIP) where the inner archive contains an executable file (e.g. webshell.php). When the application extracts the uploaded archives, the executable may be extracted into a web-accessible directory. This can lead to remote code execution (RCE), data disclosure, account compromise, or further system compromise depending on the web server/process privileges. The issue arises from insufficient validation of archive contents and inadequate restrictions on extraction targets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/Bidon47/CVE-2025-65806/blob/main/CVE-2025-65806.md; https://www.e-point.pl/produkty/e-point-cms
CVE: CVE-2025-65883
Published: 2025-12-04
Description: A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local network attacker to achieve Remote Code Execution (RCE) with root privileges. The issue occurs due to improper session invalidation after administrator logout. When an administrator logs out, the session token remains valid. An attacker on the local network can reuse this stale token to send crafted requests via the router’s diagnostic endpoint, resulting in command execution as root.
CVSS Score: 8.4 (HIGH)
CWE: CWE-613
References: https://0xw41th.medium.com/my-first-cve-cve-2025-65883-remote-code-execution-in-a-genexis-router-0c35749a99bd
CVE: CVE-2025-65958
Published: 2025-12-04
Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.
CVSS Score: 8.5 (HIGH)
CWE: CWE-918
References: https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b[PII_REDACTED]6774; https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685; https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685
CVE: CVE-2023-53734
Published: 2025-12-04
Description: dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access.
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022; https://www.exploit-db.com/exploits/51818; https://www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-download
CVE: CVE-2023-53735
Published: 2025-12-04
Description: WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling potential XSS attacks.
CWE: CWE-79
References: https://webigniter.net/; https://webigniter.net/demo; https://www.exploit-db.com/exploits/51900
CVE: CVE-2024-58275
Published: 2025-12-04
Description: Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.
CWE: CWE-88
References: https://github.com/jpylypiw/easywall; https://jpylypiw.github.io/easywall/; https://www.exploit-db.com/exploits/51856
CVE: CVE-2024-58276
Published: 2025-12-04
Description: Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.
CWE: CWE-89
References: https://github.com/Obi08/Enrollment_System; https://www.exploit-db.com/exploits/51845; https://www.vulncheck.com/advisories/obi08-enrollment-system-10-loginphp-sql-injection
CVE: CVE-2024-58277
Published: 2025-12-04
Description: R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authentication bypass and FM station setup access.
CWE: CWE-312
References: https://www.exploit-db.com/exploits/51855; https://www.vulncheck.com/advisories/r-radio-network-fm-transmitter-107-system-settings-disclosure; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5802.php
CVE: CVE-2024-58278
Published: 2025-12-04
Description: perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can control the 0th argument of packed executables to execute another executable, allowing them to bypass restrictions and gain unauthorized access.
CWE: CWE-78
References: https://www.exploit-db.com/exploits/51825; https://www.indigostar.com/; https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
CVE: CVE-2025-13543
Published: 2025-12-04
Description: The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/postgallery/tags/1.12.5/admin/PostGalleryUploader.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=cve
CVE: CVE-2025-27935
Published: 2025-12-04
Description: The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
CWE: CWE-306
References: https://support.pingidentity.com/s/article/SECADV051-PingFederate-OTP-Integration-Kit-authentication-bypass; https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE: CVE-2025-55948
Published: 2025-12-04
Description: This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests when frontend menu updates (such as privilege revocation) fail to propagate to the backend permission table in real-time, creating a dangerous desynchronization. While users lose access to restricted functions through the web interface (as UI elements properly disappear), the stale permission records still validate unauthorized API requests when accessed directly through tools like Postman. Attackers exploiting this inconsistency can perform privileged operations including but not limited to: creating high-permission user accounts, accessing sensitive data beyond their clearance level, and executing admin-level commands.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266
References: https://github.com/liuchengjie01/vuln_db/blob/master/x-springboot3x-vul/x-springboot3x-vul.md; https://github.com/yzcheng90/X-SpringBoot
CVE: CVE-2025-63896
Published: 2025-12-04
Description: An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.
CVSS Score: 7.6 (HIGH)
CWE: CWE-306
References: http://jxl.com; https://github.com/thorat-shubham/JXL_Infotainment_CVE/blob/main/README.md