Data Leakage Prevention System CVE-2025-11316

We need to produce a JSON object with all required fields based on the CVE-2025-11316 data. The data includes CVSS 4.0 vector, but we need to produce an assessed CVSS 3.1 vector and rationale, and an assessed CVSS 4.0 vector consistent with our assessment. Also, we need to synthesize from the description, EPSS, POC/exploit, tags, CPE, CWE, references. There is no KEV mention, so KEV is not active. The exploit has been publicly disclosed, so POC/Exploit is publicly available. We'll note that. The vendor didn't respond. No patch info available. So remediation should mention no vendor patch, suggest compensating controls if possible (but we need specific conditions). The description: "A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of the file findCategoryPage.do. Executing manipulation of the argument tenantId can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized." So SQL injection in tenantId parameter. Remote. No auth mentioned. The CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... So the base metrics imply network vector, low attack complexity, no attack requirements, no privileges, no user interaction, low impact on vulnerable system, no scope change. So the base score would be: CVSS 4.0 base formula: use AV:N (0.2), AC:L (0.1), AT:N (0.1) -> Attack Vector weight: 0.2 * 0.1 * 0.1? Actually need to compute properly, but we'll produce a vector consistent with the input, but we are to give our own independent assessment. Since we have little else, we might adopt the same vector as the provided CVSS 4.0 for vulnerable system metrics (VC/VI/VA=L), and SC/SI/SA=N. So our assessed CVSS 4.0 vector could be: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. The E:P is from the exploit maturity, not base. So we'll output base onl