Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Shortcutter 2 App by LeeDrOiD Labs
CVE-2026-113385 (GCVE-0-2026-113385)
Vulnerability from nvd – Published: 2026-10-20 11:15 – Updated: 2026-10-20 13:24
VLAI
EPSS
VEX
Title
LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
Summary
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:24 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422658 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422658/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113385 | third-party-advisory |
| https://vuldb.com/submit/1003932 | third-party-advisory |
| https://docs.google.com/document/d/1_CRu5x_2OFJc-… | exploit |
| https://play.google.com/store/apps/details?id=com… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LeeDrOiD Labs | Shortcutter 2 App |
Affected:
9.0.48
Unaffected: 9.0.90 cpe:2.3:a:leedroid_labs:shortcutter_2_app:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113385",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:24:41.146891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:24:51.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leedroid_labs:shortcutter_2_app:*:*:*:*:*:*:*:*"
],
"product": "Shortcutter 2 App",
"vendor": "LeeDrOiD Labs",
"versions": [
{
"status": "affected",
"version": "9.0.48"
},
{
"status": "unaffected",
"version": "9.0.90"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:15:14.699Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422658 | LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422658"
},
{
"name": "VDB-422658 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422658/cti"
},
{
"name": "CVE-2026-113385 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113385"
},
{
"name": "Submit #1003932 | LeeDrOiD Labs Shortcutter - Quick Settings \u0026 Shortcuts (com.leedroid.shortcutter) 7.8.0 (780) Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1003932"
},
{
"tags": [
"exploit"
],
"url": "https://docs.google.com/document/d/1_CRu5x_2OFJc-iZCP_GI0L88rEUOlgs3TCv9jM5L-b4/edit?usp=sharing"
},
{
"tags": [
"patch"
],
"url": "https://play.google.com/store/apps/details?id=com.leedroid.shortcutter"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T06:51:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113385",
"datePublished": "2026-10-20T11:15:14.699Z",
"dateReserved": "2026-10-20T04:46:23.665Z",
"dateUpdated": "2026-10-20T13:24:51.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113385 (GCVE-0-2026-113385)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:15 – Updated: 2026-10-20 13:24
VLAI
EPSS
VEX
Title
LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
Summary
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:24 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422658 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422658/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113385 | third-party-advisory |
| https://vuldb.com/submit/1003932 | third-party-advisory |
| https://docs.google.com/document/d/1_CRu5x_2OFJc-… | exploit |
| https://play.google.com/store/apps/details?id=com… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LeeDrOiD Labs | Shortcutter 2 App |
Affected:
9.0.48
Unaffected: 9.0.90 cpe:2.3:a:leedroid_labs:shortcutter_2_app:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113385",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:24:41.146891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:24:51.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leedroid_labs:shortcutter_2_app:*:*:*:*:*:*:*:*"
],
"product": "Shortcutter 2 App",
"vendor": "LeeDrOiD Labs",
"versions": [
{
"status": "affected",
"version": "9.0.48"
},
{
"status": "unaffected",
"version": "9.0.90"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:15:14.699Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422658 | LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422658"
},
{
"name": "VDB-422658 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422658/cti"
},
{
"name": "CVE-2026-113385 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113385"
},
{
"name": "Submit #1003932 | LeeDrOiD Labs Shortcutter - Quick Settings \u0026 Shortcuts (com.leedroid.shortcutter) 7.8.0 (780) Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1003932"
},
{
"tags": [
"exploit"
],
"url": "https://docs.google.com/document/d/1_CRu5x_2OFJc-iZCP_GI0L88rEUOlgs3TCv9jM5L-b4/edit?usp=sharing"
},
{
"tags": [
"patch"
],
"url": "https://play.google.com/store/apps/details?id=com.leedroid.shortcutter"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T06:51:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113385",
"datePublished": "2026-10-20T11:15:14.699Z",
"dateReserved": "2026-10-20T04:46:23.665Z",
"dateUpdated": "2026-10-20T13:24:51.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}