CVE-2025-5154

low-risk
Published 2025-05-25

A vulnerability, which was classified as problematic, was found in PhonePe App 25.03.21.0 on Android. Affected is an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Phonepe

Affected Vendors

Phonepe

References (6)

Not Applicable https://drive.google.com/drive/folders/1Xj9y2w3E98IZu8PUeGGI0nQPNsvVm87I?usp=sha...
Exploit https://github.com/honestcorrupt/-Insecure-Local-Storage-of-Sensitive-User-Data-...
Permissions Required https://vuldb.com/?ctiid.310242
Third Party Advisory https://vuldb.com/?id.310242
Third Party Advisory https://vuldb.com/?submit.576245
Exploit https://github.com/honestcorrupt/-Insecure-Local-Storage-of-Sensitive-User-Data-...
15
/ 100
low-risk
Severity 10/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal