A week in security (August 4 – August 10)

Last week on Malwarebytes Labs: Adult sites trick users into Liking Facebook posts using a clickjack Trojan Facebook users targeted in ‘login’ phish TeaOnHer, the male version of Tea, is leaking personal information on its users too How Google, Adidas, and more were breached in a Salesforce scam...

CVE-2025-27128

creationtimestamp| type| source ---|---|--- 2025-08-11 06:01:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw44ojzzxa2p...

CVE-2025-8745

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

CVE-2025-8813

creationtimestamp| type| source ---|---|--- 2025-08-10 18:22:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw2vl347hl2p...

CVE-2025-8806

creationtimestamp| type| source ---|---|--- 2025-08-10 15:01:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw2kexq2pn2a...

AgentFlayer 0-click exploit abuses ChatGPT Connectors to Steal 3rd-party app data

AgentFlayer is a critical vulnerability in ChatGPT Connectors. Learn how this zero-click attack uses indirect prompt injection to…...

CVE-2025-4796

creationtimestamp| type| source ---|---|--- 2025-08-10 09:01:36+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lvzwax54dm2d 2025-10-25 21:00:05+00:00| published-proof-of-concept| Telegram/CIibF5krEqXHuHs5TqPPIuQ0aPwRPsmd2xxsRxQT1IxhBk 2025-11-01 04:31:23+00:00|...

CVE-2025-8791

creationtimestamp| type| source ---|---|--- 2025-08-10 07:41:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvzrr77s462s...

CVE-2025-8790

creationtimestamp| type| source ---|---|--- 2025-08-10 03:57:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvzfaelyv52l...

CVE-2025-8785

creationtimestamp| type| source ---|---|--- 2025-08-10 03:46:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvzemnbs3y2a...

CVE-2025-8707

A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xml of the component com.huuge.game.zjbox. The manipulation leads to improper export of android application components. Local access is...

Nextcloud: Stored XSS in contacts app via organisation and title field

A stored XSS vulnerability was discovered in the contacts app of the software. The vulnerability could be triggered by inputting malicious code in the organization or title field...

Malicious code in checkout-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f3f3a1d0b011d00d475a42f290ecb00025114dbb878def81003f3cbd0ea26e7 The OpenSSF Package Analysis project identified 'checkout-app' @ 1.5.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6811 Malicious code in checkout-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f3f3a1d0b011d00d475a42f290ecb00025114dbb878def81003f3cbd0ea26e7 The OpenSSF Package Analysis project identified 'checkout-app' @ 1.5.1 npm as malicious. It is considered malicious because: - The package...

CVE-2025-7020

creationtimestamp| type| source ---|---|--- 2025-08-09 13:40:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lvxvflz4of2d...

CVE-2025-8745

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

CVE-2025-8745

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

CVE-2025-8745 Weee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

CVE-2025-8745 Weee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

CVE-2025-8745

CVE-2025-8745 affects Weee RICEPO App 6.17.77 on Android, specifically the com.ricepo.app component. The vulnerability arises from improper export of AndroidManifest.xml handling, enabling a local-attack impact (confidentiality impacted). Exploitation details are publicly disclosed; vendor was co...