{"id":"CVE-2026-18604","state":"PUBLISHED","title":"textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components","description":"A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.","publishedAt":"2026-08-03T15:45:09.011Z","updatedAt":"2026-08-03T20:06:55.762Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["textPlus Text Message and Call App"],"affected":[{"vendor":"textPlus","product":"Text Message and Call App","versions":[{"version":"8.3.0","status":"affected"},{"version":"8.3.1","status":"affected"},{"version":"8.3.2","status":"affected"},{"version":"8.3.3","status":"affected"},{"version":"8.3.4","status":"affected"},{"version":"8.3.5","status":"affected"}],"cpes":["cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"],"modules":["com.gogii.textplus"]}],"references":["https://vuldb.com/vuln/385527","https://vuldb.com/vuln/385527/cti","https://vuldb.com/cve/CVE-2026-18604","https://vuldb.com/submit/851700","https://github.com/actuator/com.gogii.textplus"],"weaknesses":["CWE-926"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18604.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18604","state":"PUBLISHED","datePublished":"2026-08-03T15:45:09.011Z","dateUpdated":"2026-08-03T20:06:55.762Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-03T07:04:48.070Z"},"containers":{"cna":{"title":"textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components","descriptions":[{"lang":"en","value":"A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}],"affected":[{"vendor":"textPlus","product":"Text Message and Call App","versions":[{"version":"8.3.0","status":"affected"},{"version":"8.3.1","status":"affected"},{"version":"8.3.2","status":"affected"},{"version":"8.3.3","status":"affected"},{"version":"8.3.4","status":"affected"},{"version":"8.3.5","status":"affected"}],"cpes":["cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"],"modules":["com.gogii.textplus"]}],"references":[{"url":"https://vuldb.com/vuln/385527","name":"VDB-385527 | textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/385527/cti","name":"VDB-385527 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-18604","name":"CVE-2026-18604 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/851700","name":"Submit #851700 | Textplus, Inc. Android https://play.google.com/store/apps/details?id=com.gogii.textplus 8.3.5 Improper Authorization","tags":["third-party-advisory"]},{"url":"https://github.com/actuator/com.gogii.textplus","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4.3,"vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-926","type":"CWE","lang":"en","description":"Improper Export of Android Application Components"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-03T15:45:09.011Z"},"timeline":[{"time":"2026-08-03T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-03T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-03T09:09:53.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Actuator (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-03T20:06:46.005144Z","id":"CVE-2026-18604","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-03T20:06:55.762Z"}}]}}}