11215 matches found
apk-interceptor
apk-interceptor Asistente de evaluación de Deeplinks, Intents y puentes WebView para Android apk-interceptor es un APK de prueba portátil para Android, destinado a evaluaciones de seguridad de aplicaciones autorizadas. Ayuda a los ingenieros de seguridad a verificar cómo una aplicación Android...
CVE-2013-4710-WebView-RCE-Vulnerability
CVE-2013-4710-WebView-RCE-Vulnerability Vulnerability Description A lot of the time we use WebView to display a Webpage,for example many applications in order to achieve the server control, many results page is Webpage, rather than the local implementation, which has many advantages, such as...
deep-C
Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...
CVE-2024-25292
RenderTune RCE Una prueba de concepto para la vulnerabilidad CVE-2024-25292. Una vulnerabilidad de cross-site scripting XSS en RenderTune v1.1.4 permite a los atacantes ejecutar scripts web arbitrarios o HTML mediante un payload manipulado inyectado en el parámetro Upload Title. En este repositor...
CVE-2024-22891
PoC de Nteract Una prueba de concepto para la vulnerabilidad CVE-2024-22891. nteract 0.28.0 permite webview de Electron a través de enlace Markdown, con la consiguiente ejecución remota de código. En este repositorio hay un ejemplo de aplicación vulnerable y un exploit de prueba de concepto PoC d...
qark
Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...
CVE-2020-1054
CVE-2020-1054 CVE-2020-1054 Aprendizaje Captura de pantalla Referencia https://0xeb-bp.github.io/blog/2020/06/15/cve-2020-1054-analysis.html robar token de seguridad https://github.com/mwrlabs/CVE-2016-7255 filtrar función https://github.com/DreamoneOnly/CVE-2019-0808-32-64-exp...
CVE-2024-25291
DeskFiler RCE A Proof-Of-Concept for CVE-2024-25291 vulnerability. deskfiler - 1.2.3 allows Electron webview in application, with resultant remote code In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python file that...
CVE-2026-26897-EcoOnline-DeepLink
EcoOnline EHS Android — Deep Link Validation Bypass → WebView Open Redirect CVE-2026-26897 Public disclosure / advisory for CVE-2026-26897 , a deep link validation bypass in the EcoOnline EHS Android application com.airsweb.v10. A crafted ehs-app:// deep link is rewritten to https:// and loaded...
CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85085
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
EUVD-2026-70915
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85094
Canva Android App versions prior to 2.376.0 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . An attacker who gains control of the WebView could read those headers and access a user's session . The CVSS 3.1 score is 8.8 (HIGH) , with a network vector...
CVE-2026-85085
The Canva Android App (versions before 2.376.0 ) contained a vulnerability in a privileged WebView that allowed an external origin to be loaded. A threat actor who controls a page visited by the user can communicate with Canva using the user's session, enabling high confidentiality and integrity ...
CVE-2026-85085
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
EUVD-2026-70914
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
CVE-2026-0628-POC
CVE-2026-0628-POC Proof of Concept PoC for CVE-2026-0628, demonstrating script injection into privileged pages through the use of the tag in Google Chrome. This vulnerability, classified as CWE-862 Missing Authorization, allows a malicious extension to bypass security policies in versions prior t...
Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation
= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X root@kitploit: README.md CVE-2026-0628: Chromium WebView Privilege Escalation Origin Spoofing – Technical Research & Proof-of-Concept Author: Sastra Adi Wiguna Purple Elite Teaming Research Date: January 2026 CVE ID: CVE-2026-0628...