40 matches found
cve-2026-28576
CVE-2026-28576: Android Contacts Provider SQL Injection and Systemic Exfiltration Executive Summary CVE-2026-28576 is a critical access control vulnerability in the Android Contacts Provider framework ContactsProvider2.queryLocal. The flaw enables an unprivileged application installed locally wit...
CVE-2026-28576-poc
CVE-2026-28576: SQL Injection in the Android Contacts Provider One picked contact, every contact: a targetSdk compat gate turns a single-contact picker grant into a full contacts database dump. Android 17 hardened the Contacts Provider against SQL injection with setStrictColumns / setStrictGramma...
Exploit for SQL Injection in Google Android
CVE-2026-28576: SQL Injection in the Android Contacts Provider...
Google Android SQL Injection Vulnerability (CNVD-2026-29386)
Google Android is an open-source operating system based on Linux, developed by Google Inc. Google Android has a SQL injection vulnerability. This vulnerability stems from the lack of validation for SQL statements submitted from external inputs by the Contacts Provider. Attackers can exploit this...
EUVD-2026-37573
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-37555
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Android, the Contacts Provider is affected by CVE-2026-28576, caused by a SQL injection in the contacts database access path. This allows local information disclosure without extra execution privileges and without user interaction. The issue is described across CVE entries and ENISA/Android re...
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057
A security vulnerability in the Contacts Provider component of Google Android allows an attacker to access an incoming call's phone number and associated metadata. The root cause is a missing permission check , which can lead to local information disclosure without requiring additional execution ...
CVE-2026-0057
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28576: Undefined Security Weakness
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-50226
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0057: Undefined Security Weakness
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-50240
Name of the Vulnerable Software and Affected Versions Contacts Provider affected versions not specified Description An SQL injection exists in Contacts Provider, allowing unauthorized access to the contacts database. This issue can result in local information disclosure without requiring addition...