CVE-2023-36621

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/Third Party Advisory
https://seclists.org/fulldisclosure/2023/Jul/12Mailing List, Third Party Advisory
https://useboomerang.com/Product
https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/Third Party Advisory
https://seclists.org/fulldisclosure/2023/Jul/12Mailing List, Third Party Advisory
https://useboomerang.com/Product

Timeline

Published: Nov 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-366227.2The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject CVE-2023-366237.8The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a lo CVE-2023-366247.8Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration CVE-2023-366272.7A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-CVE-2023-366288.8A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege es CVE-2023-366295.5The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.CVE-2023-36638.8In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote a CVE-2023-366308.8In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.CVE-2023-366317.8Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Window CVE-2023-366327.5The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exce CVE-2023-366335.4An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated CVE-2023-366348.8An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.