Search
Find a vulnerability
Search criteria
2 vulnerabilities by textPlus
CVE-2026-18604 (GCVE-0-2026-18604)
Vulnerability from nvd – Published: 2026-08-03 15:45 – Updated: 2026-08-03 20:06
VLAI
EPSS
VEX
Title
textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
Summary
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:06 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385527 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385527/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18604 | third-party-advisory |
| https://vuldb.com/submit/851700 | third-party-advisory |
| https://github.com/actuator/com.gogii.textplus | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| textPlus | Text Message and Call App |
Affected:
8.3.0
Affected: 8.3.1 Affected: 8.3.2 Affected: 8.3.3 Affected: 8.3.4 Affected: 8.3.5 cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18604",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:06:46.005144Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:06:55.762Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"
],
"modules": [
"com.gogii.textplus"
],
"product": "Text Message and Call App",
"vendor": "textPlus",
"versions": [
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.3.1"
},
{
"status": "affected",
"version": "8.3.2"
},
{
"status": "affected",
"version": "8.3.3"
},
{
"status": "affected",
"version": "8.3.4"
},
{
"status": "affected",
"version": "8.3.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:45:09.011Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385527 | textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385527"
},
{
"name": "VDB-385527 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385527/cti"
},
{
"name": "CVE-2026-18604 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18604"
},
{
"name": "Submit #851700 | Textplus, Inc. Android https://play.google.com/store/apps/details?id=com.gogii.textplus 8.3.5 Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851700"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/actuator/com.gogii.textplus"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:09:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18604",
"datePublished": "2026-08-03T15:45:09.011Z",
"dateReserved": "2026-08-03T07:04:48.070Z",
"dateUpdated": "2026-08-03T20:06:55.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18604 (GCVE-0-2026-18604)
Vulnerability from cvelistv5 – Published: 2026-08-03 15:45 – Updated: 2026-08-03 20:06
VLAI
EPSS
VEX
Title
textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
Summary
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:06 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385527 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385527/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18604 | third-party-advisory |
| https://vuldb.com/submit/851700 | third-party-advisory |
| https://github.com/actuator/com.gogii.textplus | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| textPlus | Text Message and Call App |
Affected:
8.3.0
Affected: 8.3.1 Affected: 8.3.2 Affected: 8.3.3 Affected: 8.3.4 Affected: 8.3.5 cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18604",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:06:46.005144Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:06:55.762Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:*"
],
"modules": [
"com.gogii.textplus"
],
"product": "Text Message and Call App",
"vendor": "textPlus",
"versions": [
{
"status": "affected",
"version": "8.3.0"
},
{
"status": "affected",
"version": "8.3.1"
},
{
"status": "affected",
"version": "8.3.2"
},
{
"status": "affected",
"version": "8.3.3"
},
{
"status": "affected",
"version": "8.3.4"
},
{
"status": "affected",
"version": "8.3.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:45:09.011Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385527 | textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385527"
},
{
"name": "VDB-385527 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385527/cti"
},
{
"name": "CVE-2026-18604 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18604"
},
{
"name": "Submit #851700 | Textplus, Inc. Android https://play.google.com/store/apps/details?id=com.gogii.textplus 8.3.5 Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851700"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/actuator/com.gogii.textplus"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:09:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18604",
"datePublished": "2026-08-03T15:45:09.011Z",
"dateReserved": "2026-08-03T07:04:48.070Z",
"dateUpdated": "2026-08-03T20:06:55.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}