CVE-2026-18604

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18604", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-03T07:04:48.070Z", "datePublished": "2026-08-03T15:45:09.011Z", "dateUpdated": "2026-08-03T20:06:55.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-03T15:45:09.011Z"}, "title": "textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-926", "lang": "en", "description": "Improper Export of Android Application Components"}]}], "affected": [{"vendor": "textPlus", "product": "Text Message and Call App", "versions": [{"version": "8.3.0", "status": "affected"}, {"version": "8.3.1", "status": "affected"}, {"version": "8.3.2", "status": "affected"}, {"version": "8.3.3", "status": "affected"}, {"version": "8.3.4", "status": "affected"}, {"version": "8.3.5", "status": "affected"}], "cpes": ["cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"], "modules": ["com.gogii.textplus"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-03T09:09:53.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Actuator (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/385527", "name": "VDB-385527 | textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385527/cti", "name": "VDB-385527 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18604", "name": "CVE-2026-18604 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/851700", "name": "Submit #851700 | Textplus, Inc. Android https://play.google.com/store/apps/details?id=com.gogii.textplus 8.3.5 Improper Authorization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/actuator/com.gogii.textplus", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T20:06:46.005144Z", "id": "CVE-2026-18604", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T20:06:55.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18604", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T20:06:46.005144Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T20:06:51.072Z"}}], "cna": {"title": "textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components", "credits": [{"lang": "en", "type": "reporter", "value": "Actuator (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"], "vendor": "textPlus", "modules": ["com.gogii.textplus"], "product": "Text Message and Call App", "versions": [{"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.3.1"}, {"status": "affected", "version": "8.3.2"}, {"status": "affected", "version": "8.3.3"}, {"status": "affected", "version": "8.3.4"}, {"status": "affected", "version": "8.3.5"}]}], "timeline": [{"lang": "en", "time": "2026-08-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-03T09:09:53.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/385527", "name": "VDB-385527 | textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385527/cti", "name": "VDB-385527 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18604", "name": "CVE-2026-18604 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/851700", "name": "Submit #851700 | Textplus, Inc. Android https://play.google.com/store/apps/details?id=com.gogii.textplus 8.3.5 Improper Authorization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/actuator/com.gogii.textplus", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "Improper Export of Android Application Components"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-03T15:45:09.011Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18604", "state": "PUBLISHED", "dateUpdated": "2026-08-03T20:06:55.762Z", "dateReserved": "2026-08-03T07:04:48.070Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-03T15:45:09.011Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"], "modules": ["com.gogii.textplus"], "product": "Text Message and Call App", "vendor": "textPlus", "versions": [{"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.3.1"}, {"status": "affected", "version": "8.3.2"}, {"status": "affected", "version": "8.3.3"}, {"status": "affected", "version": "8.3.4"}, {"status": "affected", "version": "8.3.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en la aplicaci\u00f3n textPlus Text Message and Call App hasta la versi\u00f3n 8.3.5 en Android. Esto afecta a la funci\u00f3n DialerActivity del componente com.gogii.textplus. Dicha manipulaci\u00f3n conduce a una exportaci\u00f3n indebida de componentes de la aplicaci\u00f3n Android. El ataque debe realizarse localmente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n."}], "id": "CVE-2026-18604", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18604", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T20:06:46.005144Z", "version": "2.0.3"}}]}, "published": "2026-08-03T17:16:35.353", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/actuator/com.gogii.textplus"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-18604"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/851700"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385527"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385527/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Text Message and Call App", "source": "cna", "vendor": "textPlus"}, "product": "text_message_and_call_app", "vendor": "textplus"}], "created": "2026-08-04T10:15:04.651958+00:00", "updated": "2026-08-05T10:22:08.493066+00:00", "vendors": ["textplus", "textplus$PRODUCT$text_message_and_call_app"]}