objection

📱objection - 런타임 모바일 탐색 objection은 Frida를 기반으로 한 런타임 모바일 탐색 도구 키트로, 탈옥 없이 모바일 애플리케이션의 보안 상태를 평가할 수 있도록 돕기 위해 만들어졌습니다. iOS와 Android를 모두 지원합니다. 컨테이너 파일 시스템을 검사하고 상호 작용합니다. SSL 피닝을 우회합니다. 키체인을 덤프합니다. 덤프 및 패치와 같은 메모리 관련 작업을 수행합니다. 힙에 있는 객체를 탐색하고 조작합니다. 그 외에도 훨씬 더 많은 기능이 있습니다... 스크린샷은 위키에서 확인할 수 있습니다...

trueseeing

README trueseeing — это быстрый, точный и устойчивый сканер уязвимостей для iOS/Android-приложений. Мы работаем на уровне Dalvik VM для Android — то есть нам неважно, обфусцировано целевое приложение или нет. Возможности В настоящее время мы можем: Автоматически сканировать приложение на...

appmon

Добро пожаловать в AppMon! Как было показано на США и ЕС AppMon — это автоматизированный фреймворк для мониторинга и модификации системных API-вызовов нативных приложений macOS, iOS и Android. Он основан на Frida. Этот проект стал возможен только благодаря Ole André Vadla Ravnås , и я посвящаю ег...

slythestx

🐍 Slythestx 모바일 보안을 위한 스위스 아미 웜 iOS와 Android에서 정적 코드 분석 및 동적 취약점 헌팅을 위한 통합 프레임워크입니다. 📖 목차 개요 주요 기능 아키텍처 분석기 모음 빠른 시작 사용법 릴리스 노트 로드맵 기여 면책 조항 라이선스 ⚡ 개요 Slythestx 는 정적 분석SAST과 동적 분석DAST을 단일 인터페이스로 통합한 모바일 보안 툴킷입니다. 대상의 기술 스택을 신속하게 식별하고, 소스에서 알려진 위험 패턴을 감사하며, 실기기와 상호작용해야 하는 보안 연구원과 모바일 침투 테스터를 위해...

PT-2026-71379

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app affected versions not specified Description Improper certificate validation allows an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. MitM is ...

CVE-2026-7671 CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of...

CVE-2026-26327

OpenClaw is a personal AI assistant. Discovery beacons Bonjour/mDNS and DNS-SD include TXT records such as lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256. TXT records are unauthenticated. Prior to version 2026.2.14, some clients treated TXT values as authoritative routing/pinning inputs...

EUVD-2020-26957

Malware in sbrugna...

EUVD-2021-32256

Malicious code in bioql PyPI...

EUVD-2024-31895

Malicious code in bioql PyPI...

CVE-2025-53649

"SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerability is exploited, sensitive user information may be exposed to an attacker who has access to the application logs...

CVE-2025-30609 WordPress AppExperts plugin <= 1.4.3 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through = 1.4.3...

CVE-2025-30609

CVE-2025-30609 corresponds to an AppExperts vulnerability in AppExperts – WordPress to Mobile App – WooCommerce to iOS and Android Apps. The issue is described as an Insertion of Sensitive Information Into Sent Data, allowing retrieval of embedded sensitive data. Affected products/versions: AppEx...

Detecting Pegasus Infections

This tool seems to do a pretty good job. The company's Mobile Threat Hunting feature uses a combination of malware signature-based detection, heuristics, and machine learning to look for anomalies in iOS and Android device activity or telltale signs of spyware infection. For paying iVerify...

CVE-2022-45636

An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock models without authorization via arbitrary API requests...

CVE-2022-45636

An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock models without authorization via arbitrary API requests...

CVE-2020-5800

The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they would not normally have access to...

CVE-2016-6540 TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been...

iClassSchedule 1.6 iOS & Android - Persistent Vulnerability

Document Title: =============== iClassSchedule 1.6 iOS & Android - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1494 Release Date: ============= 2015-05-13 Vulnerability Laboratory ID VL-ID: ===================================...

10 year old girl hacker CyFi reveal her first zero-day in Game at #DefCon 19

10 year old girl hacker CyFi reveal her first zero-day in Game at DefCon 19 Another awesome day at DefCon 19 . Today a 10 year old Girl hacker - pseudonym CyFi revealed her zero-day exploit in games on iOS and Android devices that independent researchers have confirmed as a new class of...