CVE-2018-17403

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account without their knowledge. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-174045.3The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile CVE-2018-174077.8An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the CVE-2018-174087.8Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a CVE-2018-17416.5IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cau CVE-2018-174109.8Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.CVE-2018-174119.8An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.CVE-2018-174129.8zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.CVE-2018-174136.1XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.CVE-2018-174148.8zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.CVE-2018-174158.8zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.CVE-2018-174167.2A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.CVE-2018-174187.2Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP file