mavd

mavd 移动应用漏洞检测 从 CLI 接收域名或 APK 名称，识别与该域名关联的大多数应用并在本地下载 APK。然后使用 dex2jar 将 APK 逆向为 jar 文件，提取类文件和对象，并在代码中搜索 'secret' 类型的关键词和 URL。...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...