CVE-2026-4251

LowCVSS 2.5/10Last modified Jun 17, 2026

Description

A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-255CWE-256

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-425107.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.CVE-2026-425118.1The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf dirCVE-2026-425128.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expanCVE-2026-425138.8This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authCVE-2026-425148.8This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulneCVE-2026-425157.1This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploitCVE-2026-425167.1This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit CVE-2026-425177.1This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attackerCVE-2026-425188.7This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScripCVE-2026-425194.3A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission tCVE-2026-42529.8A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler.CVE-2026-425207.5Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing a