static bool inRange(cchar *expr, cchar *version)
{
    char    *cp, *op, *base, *pre, *low, *high, *preVersion;
    int64   min, max, numberVersion;
    ssize   i;

    if ((i = strspn(expr, "<>=~ \t")) > 0) {
        op = snclone(expr, i);
        expr = &expr[i];
    } else {
        op = 0;
    }
    if (smatch(expr, "*")) {
        expr = "x";
    }
    version = ssplit(sclone(version), "-", &preVersion);
    base = ssplit(sclone(expr), "-", &pre);
    if (op && (*op == '~' || *op == '^')) {
        if (*op == '^' && schr(version, '-')) {
            return 0;
        }
        base = slower(base);
        if ((cp = scontains(base, ".x")) != 0) {
            *cp = '\0';
        }
        return sstarts(version, base);
    }
    if (scontains(base, "x") && !schr(version, '-')) {
        low = sfmt(">=%s", sreplace(base, "x", "0"));
        high = sfmt("<%s", sreplace(base, "x", VER_FACTOR_MAX));
        return inRange(low, version) && inRange(high, version);
    }
    min = 0;
    max = MAX_VER;
    if (!op) {
        min = max = asNumber(base);
    } else if (smatch(op, ">=")) {
        min = asNumber(base);
    } else if (*op == '>') {
        min = asNumber(base) + 1;
    } else if (smatch(op, "<=")) {
        max = asNumber(base);
    } else if (*op == '<') {
        max = asNumber(base) - 1;
    } else {
        min = max = asNumber(base);
    }
    numberVersion = asNumber(version);
    if (min <= numberVersion && numberVersion <= max) {
        if ((pre && smatch(pre, preVersion)) || (!pre && !preVersion)) {
            return 1;
        }
    }
    return 0;
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.