CVE-2025-8707

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xml of the component com.huuge.game.zjbox. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-926

Affected software

Vendor	Product	Versions
Huuge	Box App	1.0.3

References

https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.mdExploit, Third Party Advisory
https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md#steps-to-reproduceExploit, Third Party Advisory
https://vuldb.com/?ctiid.319137Permissions Required, VDB Entry
https://vuldb.com/?id.319137Third Party Advisory, VDB Entry
https://vuldb.com/?submit.619858Third Party Advisory, VDB Entry
https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.mdExploit, Third Party Advisory
https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md#steps-to-reproduceExploit, Third Party Advisory

Timeline

Published: Aug 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-87087.5A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieReme CVE-2025-87097.3A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. CVE-2025-87115.4CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva CVE-2025-87125.4Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22 CVE-2025-87133.1PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a CVE-2025-87148.8Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-tim CVE-2025-87158.8Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time ex CVE-2025-87165.8In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected fi CVE-2025-87196.4The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘base_lang’ parameter in a CVE-2025-87206.4The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to,CVE-2025-87216.4The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions CVE-2025-87226.4The Content Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid and List widgets in all versions u