CVE-2025-8707
Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application components
- State
- Published
- Severity
- 4.8 Medium
- Published
- Aug 8, 2025
- Updated
- Aug 8, 2025
- Reserved
- Aug 7, 2025
Description
A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xml of the component com.huuge.game.zjbox. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-926 Improper Export of Android Application Components
Affected Products
| Product | Versions |
|---|---|
Box AppHuuge |
|
References
- VDB-319137 | Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application componentsvdb-entry
- VDB-319137 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #619858 | Paulet team Huuge Box(com.huuge.game.zjbox) 1.0.3 Task Hijackingthird-party-advisory
- https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.mdrelated
- https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md#steps-to-reproduceexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.