116 matches found
viber-desktop-html-injection
Viber Desktop — HTML इंजेक्शन CVE-2025-55996 CVE: CVE-2025-55996 खोजकर्ता: Thaw Khant Cycbake उत्पाद: Viber Desktop प्रभावित: Viber Desktop 25.6.0 और संभवतः पूर्व संस्करण सारांश Viber Desktop का डीप-लिंक हैंडलर viber://forward?text= मैसेज कंपोज़/फ़ॉरवर्ड इंटरफ़ेस के अंदर text पैरामीटर में प्रदान...
CVE-2023-41898_Lab
CVE-2023-41898 Unvalidated Deep Link Lab Dieses Lab ist eine pädagogische, verkleinerte Reproduktion, die auf dem öffentlichen Schwachstellenbericht GHSL-2023-142 für Home Assistant Companion for Android und der Open-Source-Struktur der verwundbaren Version 2023.8.2 basiert. Es werden keine echte...
CVE-2026-26897-EcoOnline-DeepLink
EcoOnline EHS Android — Bypass della validazione dei deep link → Reindirizzamento aperto WebView CVE-2026-26897 Divulgazione pubblica / advisory per CVE-2026-26897 , un bypass della validazione dei deep link nell'applicazione Android EcoOnline EHS com.airsweb.v10. Un deep link ehs-app://...
deep-C
Deep-C Deep-C è un Android Deep Link Exploitation Framework che decompila automaticamente APK, identifica punti di ingresso esposti e insicuri dei deep link, verifica l'exploitabilità utilizzando analisi statica e verifica AI opzionale , e genera adb Proof-of-Concepts PoCs eseguibili. Deep-C è...
Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.
Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...
Exploit for Code Injection in Home-Assistant Home_Assistant_Companion
CVE-2023-41898 Unvalidated Deep Link Lab Home Assistant Compa...
CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...
CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...
CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
EUVD-2026-49328
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...
CVE-2026-66395
SiYuan Desktop before v3.7.2 is affected by a reflected XSS in the bazaar plugin readme handler that enables RCE via a crafted siyuan:// deep link. An attacker can inject HTML payloads through the plugin name parameter, which render with insertAdjacentHTML in an insecure Electron renderer and gra...
PT-2026-64996
Name of the Vulnerable Software and Affected Versions SiYuan desktop versions prior to 3.7.2 Description A reflected cross-site scripting issue exists in the bazaar plugin readme handler. An attacker can execute arbitrary code by crafting a malicious siyuan:// deep link. By injecting HTML payload...
CVE-2026-48745
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The...
CVE-2026-48745 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The...
Exploit for CVE-2026-26897
EcoOnline EHS Android — Deep Link Validation Bypass → WebVie...
PT-2026-45077
Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20 Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or...
CVE-2026-35020
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell...
CVE-2026-35020
...
CVE-2026-35020 Anthropic Claude Code & Agent SDK OS Command Injection via TERMINAL Environment Variable
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell...