923 matches found
mastg
OWASP Mobile Application Security Testing Guide MASTG The OWASP Mobile Application Security Testing Guide MASTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration MASWE...
MobileApp-Pentest-Cheatsheet
Mobile Application Penetration Testing Cheat Sheet La hoja de referencia de pentest de aplicaciones móviles fue creada para proporcionar una colección concisa de información de alto valor sobre temas específicos de pruebas de penetración en aplicaciones móviles y una lista de verificación, que es...
SafeForge
SafeForge – Where Apps Are Built with Trust SafeForge is an open-source mobile app hub built on GitLab that allows developers to build, upload, share, and collaborate on mobile applications in a secure, AI-verified, and fully encrypted ecosystem. Every application submitted to SafeForge is analyz...
DVHMA
DVHMA Damn Vulnerable Hybrid Mobile App DVHMA is an hybrid mobile app for Android that intentionally contains vulnerabilities. Its purpose is to enable security professionals to test their tools and techniques legally, help developers better understand the common pitfalls in developing hybrid...
WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass
Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users. id: CVE-2024-50477 info: name: WordPress Stacks Mobile App Builder =5.2.3 - Authentication Bypass...
Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover
Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...
KeyDecoder
KeyDecoder KeyDecoder es una aplicación móvil creada para pentesters y entusiastas de la seguridad. A partir de la fotografía de una llave, se puede medir su codificación bitting fácilmente. Desarrollada por Maxime BEASSE y Quentin CLEMENT. En colaboración con FrenchKey y CNS de ESIEA. Impulsada...
By-Poloss..-..CVE-2026-10580
CVE-2026-10580: Hippoo Mobile App for WooCommerce = 1.9.4 - Unauthenticated Authentication Bypass to Admin Takeover Unauthenticated → Administrator Account Takeover via Logic Conflation Bug 📌 Summary...
SocialFishMobile
SocialFish Mobile This app is an open-source project to remote control SocialFish, it does not work independently. How to build root@kitploit: Prepare your Flutter environment Go to https://flutter.dev/docs/get-started/install After configured go ahead Clone this repository $ git clone...
ShiningAppMask-ReverseEngineering
ShiningAppMask-ReverseEngineering Intro After recently buying a Shining App Mask, I was curious about the Shining Mask App and mask and how they worked. I decided to reverse engineer it to understand how it worked. The journey started with the hardware. The Android Mobile App can be found here:...
CVE-2026-10580
WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Bypass de Autenticación para Toma de Control de Cuenta de Administrador Resumen Esta herramienta es un exploit de prueba de concepto para CVE-2026-10580 , una vulnerabilidad de bypass de autenticación que afecta al plugin de WordPress Hippoo...
CVE-2026-6223
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2026-6223
CVE-2026-6223 is a CRITICAL (CVSS 9.4) improper restriction of excessive authentication attempts vulnerability in the Bahçelievler Municipality BiHayat App (versions 2.1.7 through 07092026), allowing an OTP bypass that leads to full authentication bypass. The vector is network-based with no privi...
CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass
CVE-2025-46018 – CSC Pay 移动应用支付认证绕过 摘要 在 CSC Pay 移动应用（版本 2.19.4 ）中发现了一个支付认证绕过漏洞 。该漏洞允许攻击者发起支付，在流程的特定时刻禁用蓝牙，从而无需付费 即可启动洗衣机。 此问题已负责任地披露，现跟踪为 CVE-2025-46018 。 受影响产品 产品 ：CSC Pay 移动应用 版本 ：2.19.4（已在 2.20.0 版本中修复） 组件 ：蓝牙支付认证模块 供应商 ：CSC ServiceWorks 漏洞类型 CWE-284：访问控制不当 CVSS（预估）：中危 利用类型：本地 – 需要接近机器...
Hippoo-Mobile-App-For-WooCommerce-CVE-Report
Hippoo-Mobile-App-for-WooCommerce-CVE-Report Disclosure for CVE-2025-13339 CVE-2025-13339 - Vulnerability in Hippoo Mobile App for WooCommerce This repository discloses a vulnerability discovered in Hippoo Mobile App for WooCommerce = 1.6.1,WordPress plugin developed by hippooo. 🛠 Affected Versio...
CVE-2024-50477
CVE-2024-50477 Stacks Mobile App Builder = 5.2.3 - 绕过身份验证导致账户接管 描述： Stacks Mobile App Builder – WordPress 最强大的移动应用拖放构建插件，在包括 5.2.3 在内的所有版本中存在身份验证绕过漏洞。这是因为插件在通过 receiverequestcheckout 函数对用户进行身份验证之前，未能正确验证用户身份。这使得未经验证的攻击者能够根据用户 ID 以任何用户身份登录。 root@kitploit: Published: 2024-10-25 00:00:00 CVE:...
CVE-2026-27330
Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...
CVE-2026-27330
An unauthenticated Broken Access Control vulnerability affects the WordPress plugin Mobile App for WooCommerce in versions ≤ 0.4.62 , as reported by researcher Phat RiO and cataloged by Patchstack. The flaw allows a remote attacker with no prior authentication or user interaction to access protec...
