38 matches found
cve-2026-28576
CVE-2026-28576: Android Contacts Provider の SQL インジェクションと体系的なデータ窃取 エグゼクティブサマリー CVE-2026-28576 は、Android Contacts Provider フレームワーク ContactsProvider2.queryLocal における重大なアクセス制御の脆弱性です。この欠陥により、宣言されたパーミッションがゼロ の状態でローカルにインストールされた非特権アプリケーションが、デバイス全体の連絡先データベースを窃取でき、氏名、電話番号、住所、メールアドレスを含むすべての情報が漏洩します。 属性| 値...
CVE-2026-28576-poc
CVE-2026-28576: Android 連絡先プロバイダーにおけるSQLインジェクション 1件の連絡先を選択しただけで、すべての連絡先が漏洩する: targetSdk互換ゲートにより、単一連絡先ピッカーの権限付与が連絡先データベース全体のダンプに変わる。 Android 17 は Contacts Provider を setStrictColumns / setStrictGrammar でSQLインジェクションに対して強化しましたが、その強化は targetSdk ゲート付きの互換性変更 ENFORCESTRICTSQLCHECKS、id...
Exploit for SQL Injection in Google Android
CVE-2026-28576: SQL Injection in the Android Contacts Provider...
Google Android SQL Injection Vulnerability (CNVD-2026-29386)
Google Android is an open-source operating system based on Linux, developed by Google Inc. Google Android has a SQL injection vulnerability. This vulnerability stems from the lack of validation for SQL statements submitted from external inputs by the Contacts Provider. Attackers can exploit this...
EUVD-2026-37573
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-37555
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Android, the Contacts Provider is affected by CVE-2026-28576, caused by a SQL injection in the contacts database access path. This allows local information disclosure without extra execution privileges and without user interaction. The issue is described across CVE entries and ENISA/Android re...
CVE-2026-0057
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057
A security vulnerability in the Contacts Provider component of Google Android allows an attacker to access an incoming call's phone number and associated metadata. The root cause is a missing permission check , which can lead to local information disclosure without requiring additional execution ...
CVE-2026-0057: Undefined Security Weakness
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576: Undefined Security Weakness
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-50240
Name of the Vulnerable Software and Affected Versions Contacts Provider affected versions not specified Description An SQL injection exists in Contacts Provider, allowing unauthorized access to the contacts database. This issue can result in local information disclosure without requiring addition...
PT-2026-50226
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...