CVE-2025-8523

CVE-2025-8523 affects RiderLike Fruit Crush-Brain App 1.0 on Android, with improper export of AndroidManifest.xml in the com.fruitcrush.fun component. This allows launching an attack on the local host and exploitation has been publicly disclosed. Vendor has not responded to disclosure. Connected ...

DotWallet App 安全漏洞

DotWallet App is a digital asset wallet application from China-based DotWallet. A security vulnerability exists in DotWallet App version 2.15.2, which stems from improper export of AndroidManifest.xml...

RiderLike Fruit Crush-Brain App 安全漏洞

RiderLike Fruit Crush-Brain App is a mobile game by RiderLike. A security vulnerability exists in RiderLike Fruit Crush-Brain App version 1.0, which originates from improper export of AndroidManifest.xml...

CVE-2025-8513 Caixin News App com.caixin.news AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.caixin.news. The manipulation leads to improper export of android application components. Local access is...

Cool Mo Magical Number App 安全漏洞

Cool Mo Magical Number App is an Android Entertainment app from Cool Mo. A security vulnerability exists in Cool Mo Magical Number App version 1.0.3 and earlier, which stems from improper export of the AndroidManifest.xml component...

CVE-2025-8210 Yeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application components

A vulnerability was found in Yeelink Yeelight App up to 3.5.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component com.yeelight.cherry. The manipulation leads to improper export of android application components...

PT-2025-30986 · Canara Bank · Canara Ai1 Mobile Banking App

Name of the Vulnerable Software and Affected Versions: Canara ai1 Mobile Banking App version 3.6.23 Description: A problematic issue exists due to improper export of android application components resulting from unknown processing of the AndroidManifest.xml file within the com.canarabank.mobility...

CVE-2025-7893 Foresight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application components

A vulnerability classified as problematic was found in Foresight News App up to 2.6.4 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml of the component pro.foresightnews.appa. The manipulation leads to improper export of android application components. Attacking...

CVE-2025-7889 CallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application components

A vulnerability was found in CallApp Caller ID App up to 2.0.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component caller.id.phone.number.block. The manipulation leads to improper export of android application...

InstantBits Web Video Cast App 安全漏洞

InstantBits Web Video Cast App is a cross-platform casting app from US-based InstantBits. A security vulnerability exists in InstantBits Web Video Cast App version 5.12.4 and earlier, which stems from improper export of the AndroidManifest.xml file component com.instantbits.cast.webvideo...

Dunamu StockPlus App 安全漏洞

Dunamu StockPlus App is a mobile stock information and investment management tool from Dunamu Korea. A security vulnerability exists in Dunamu StockPlus App version 7.62.10 and earlier, which stems from improper export of the AndroidManifest.xml file component com.dunamu.stockplus...

CallApp Caller ID App 安全漏洞

CallApp Caller ID App is an intelligent caller identification and blocking application from the Israeli company CallApp A security vulnerability exists in CallApp Caller ID App version 2.0.4 and earlier, which stems from an improper export of the caller.id.phone.number.block component of the...

CVE-2022-20212

In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2024-0245

A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a...

CVE-2024-0245 Task Hijacking in hamza417/inure

A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a...

CVE-2024-0245

CVE-2024-0245 affects the Inure app (hamza417/inure) prior to build97. The root cause is a misconfiguration in AndroidManifest.xml, enabling task hijacking where a malicious app can inherit permissions and potentially access sensitive data when installed on the victim’s device. Impact is describe...

CVE-2024-0245 Task Hijacking in hamza417/inure

A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a...

CVE-2024-2364 Musicshelf Backup androidmanifest.xml backup

A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch...

XML External Entity (XXE)

jadx-core is vulnerable to xml external entity attacks. The vulnerability exists in the parseXml function of ExportGradleProject.java as it does not set disallow-doctype-decl attribute in the DocumentBuilderFactory, allowing an attacker to export a malicious android application with a crafted...

in skylot/jadx

Description parseXml function in ExportGradleProject is not secured against XXE because it does not include the disallow-doctype-decl attribute, therefore JADX is vulnerable to XXE when parsing a malicious Android Manifest when exporting Android app to Gradle. In...