CVE-2023-28153

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the "Display over other apps" permission.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-281549.8Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker wh CVE-2023-281556.1The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-proto CVE-2023-281585.4Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authentica CVE-2023-281594.3The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or CVE-2023-28166.5Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patc CVE-2023-281606.5When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking po CVE-2023-281618.8If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permis CVE-2023-281628.8While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially CVE-2023-281636.5When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would h CVE-2023-281646.5Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. Th CVE-2023-281654.3Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Cont CVE-2023-281666.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions.