CVE-2025-8275

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in bsc Peru Cocktails App 1.0.0 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component bsc.devy.peru_cocktails. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-926

Affected software

No affected versions have been published.

Timeline

Published: Jul 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-82764.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improp CVE-2025-82773.1A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fail CVE-2025-82799.8Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution CVE-2025-82805.8The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back CVE-2025-82817.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl CVE-2025-82823.5The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow CVE-2025-82833.7A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being re CVE-2025-82849.8By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow CVE-2025-82855.3Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel su CVE-2025-82869.3The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configur CVE-2025-82897.5The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 vi CVE-2025-82906.4The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and inc