{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "KL-001-2026-01 yintibao Fun",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "KoreLogic Disclosures via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking\n\nTitle: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking\nAdvisory ID: KL-001-2026-001\nPublication Date: 2026-01-08\nPublication URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt\n\n\n1. Vulnerability Details\n\n\u00a0 \u00a0 \u00a0Affected Vendor: yintibao\n\u00a0 \u00a0 \u00a0Affected Product: Fun Print Mobile\n\u00a0 \u00a0 \u00a0Affected Version: 6.05.15\n\u00a0 \u00a0 \u00a0Platform: ARM64 - Android\n\u00a0 \u00a0 \u00a0CWE Classification: CWE-926: Improper Export of Android\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Application Components\n\u00a0 \u00a0 \u00a0CVE ID: CVE-2025-15464\n\n\n2. Vulnerability Description\n\n\u00a0 \u00a0 \u00a0Exported Activity allows external applications to gain\n\u00a0 \u00a0 \u00a0application context and directly launch Gmail with inbox access,\n\u00a0 \u00a0 \u00a0bypassing security controls.\n\n\n3. Technical Description\n\n\u00a0 \u00a0 \u00a0* Performed on Android 13 aarch64 - Samsung (Galaxy Tab A7 Lite)\n\u00a0 \u00a0 \u00a0* Using Frida client on Ubuntu 24.04 LTS - Frida server on\n\u00a0 \u00a0 \u00a0 \u00a0Samsung Rooted Device.\n\u00a0 \u00a0 \u00a0* The target Activity is exported true. Which means any\n\u00a0 \u00a0 \u00a0 \u00a0application may interact with it, given that permissions are\n\u00a0 \u00a0 \u00a0 \u00a0provided.\n\u00a0 \u00a0 \u00a0* The attacking host needs to attach the device email to the\n\u00a0 \u00a0 \u00a0 \u00a0application; then the account can be used by the application.\n\n\u00a0 \u00a0 \u00a0The PandoraEntry activity is exported (android:exported=\"true\")\n\u00a0 \u00a0 \u00a0and processes external intents without validation.\u00a0 Below is\n\u00a0 \u00a0 \u00a0the PandoraEntryActivity code:\n\n\u00a0 \u00a0 \u00a0protected void onCreate(Bundle bundle) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0// ... INITALIZATION CODE ...\u00a0 super.onCreate(bundle);\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0// BELOW EXTERNAL INTENT ACCEPTED WITHOUT VALIDATION Intent\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0intent = getIntent();\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0// ... PROCESSING CONTINUES WITH UNVALIDATED INTENT ...\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0if (intent.hasExtra(IntentConst.START_FROM_TO_CLASS) \u0026\u0026\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0SDK.isUniMPSDK()) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0String stringExtra =\n\u00a0intent.getStringExtra(IntentConst.START_FROM_TO_CLASS);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0if (!TextUtils.isEmpty(stringExtra) \u0026\u0026\n\u00a0stringExtra.startsWith(\"io.dcloud.feature.sdk.multi\")) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0intent.setClassName(getPackageName(), stringExtra);\n\u00a0intent.removeExtra(IntentConst.START_FROM_TO_CLASS);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0}\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0} else {\n\u00a0intent.putExtra(IntentConst.WEBAPP_SHORT_CUT_CLASS_NAME,\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0PandoraEntry.class.getName()); intent.setClass(this,\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0PandoraEntryActivity.class);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0}\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0//UNVALIDATED INTENT FORWARDED startActivity(intent);\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0overridePendingTransition(0, 0);\n\u00a0 \u00a0 \u00a0}\n\n\n4. Mitigation and Remediation Recommendation\n\n\u00a0 \u00a0 \u00a0No response from vendor. There are no known mitigations to\n\u00a0 \u00a0 \u00a0end-users of the affected application version(s).\n\n5. Credit\n\n\u00a0 \u00a0 \u00a0This vulnerability was discovered by Felix Segoviano of\n\u00a0 \u00a0 \u00a0KoreLogic, Inc.\n\n\n6. Disclosure Timeline\n\n\u00a0 \u00a0 \u00a02025-12-01 : KoreLogic requests security contact from vendor\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 via weizhengsl () vip qq com and 277517409 () qq com.\n\u00a0 \u00a0 \u00a02025-12-08 : KoreLogic submits vulnerability details to vendor\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 via weizhengsl () vip qq com and 277517409 () qq com.\n\u00a0 \u00a0 \u00a02026-01-08 : KoreLogic public disclosure.\n\n\n7. Proof of Concept\n\n\u00a0 \u00a0 \u00a0URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt\n\u00a0 \u00a0 \u00a0SHA256sum: ddb3c840c94b204fbbe2931a68771ae28d8ea9c778310cfa83e218a64a41ffd5\n\n\n\nThe contents of this advisory are copyright(c) 2026\nKoreLogic, Inc. and are licensed under a Creative Commons\nAttribution Share-Alike 4.0 (United States) License:\nhttp://creativecommons.org/licenses/by-sa/4.0/\n\nKoreLogic, Inc. is a founder-owned and operated company with a\nproven track record of providing security services to entities\nranging from Fortune 500 to small and mid-sized companies. We\nare a highly skilled team of senior security consultants doing\nby-hand security assessments for the most important networks in\nthe U.S. and around the world. We are also developers of various\ntools and resources aimed at helping the security community.\nhttps://www.korelogic.com/about-korelogic.html\n\nOur public vulnerability disclosure policy is available at:\nhttps://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-926",
              "description": "CWE-926",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/12"
        },
        {
          "url": "http://creativecommons.org/licenses/by-sa/4.0/"
        },
        {
          "url": "https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy"
        },
        {
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt"
        },
        {
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.korelogic.com/about-korelogic.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-15464",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0211",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/12",
            "automated": true,
            "contentSha256": "f9ca029e23bb782597524f8956f00ca2dbb1b9215a0823cb7adb2f17a243aa76",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T21:03:37Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0211"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0211"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}