opensecurity records
18 published records for vendor opensecurity.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 94.4%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-918 Server-Side Request Forgery (SSRF)4
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-276 Incorrect Default Permissions1
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)1
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
18 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2024-43399No exploit | Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Filesopensecurity · mobile security framework · CWE-23 | Critical9.8 | — | 0.9% | Aug 19, 2024 |
39Monitor | CVE-2025-31116No exploit | Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebindingopensecurity · mobile security framework · CWE-918 | Critical9.8 | — | 0.4% | Mar 31, 2025 |
34Monitor | CVE-2025-24805No exploit | Local Privilege Escalation in MobSFopensecurity · mobile security framework · CWE-269 | High8.5 | — | 0.3% | Feb 5, 2025 |
34Monitor | CVE-2025-46335No exploit | Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Uploadopensecurity · mobile security framework · CWE-79 | High8.6 | — | 0.3% | May 5, 2025 |
33Monitor | CVE-2025-24803No exploit | Stored Cross-Site Scripting (XSS) in MobSFopensecurity · mobile security framework · CWE-79 | High8.4 | — | 0.3% | Feb 5, 2025 |
30Monitor | CVE-2022-41547No exploit | Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzeopensecurity · mobile security framework · CWE-98 | High7.5 | — | 1.5% | Oct 18, 2022 |
30Monitor | CVE-2023-42261No exploit | Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions.opensecurity · mobile security framework · CWE-276 | High7.5 | — | 0.8% | Sep 21, 2023 |
30Monitor | CVE-2024-29190No exploit | MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)opensecurity · mobile security framework · CWE-918 | High7.5 | — | 0.7% | Mar 22, 2024 |
30Monitor | CVE-2024-54000No exploit | Mobile Security Framework (MobSF) bypass of SSRF fixopensecurity · mobile security framework · CWE-918 | High7.5 | — | 0.4% | Dec 3, 2024 |
26Monitor | CVE-2025-58162No exploit | MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extractionopensecurity · mobile security framework · CWE-22 | Medium6.5 | — | 0.6% | Sep 2, 2025 |
26Monitor | CVE-2025-46730No exploit | Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attackopensecurity · mobile security framework · CWE-409 | Medium6.5 | — | 0.5% | May 5, 2025 |
26Monitor | CVE-2026-33545No exploit | MobSF has SQL Injection in its SQLite Database Viewer Utilsopensecurity · mobile security framework · CWE-89 | Medium6.5 | — | 0.4% | Mar 26, 2026 |
21Monitor | CVE-2024-41955Proof of concept | Mobile Security Framework (MobSF) has an Open Redirect in Login Redirectopensecurity · mobile security framework · CWE-601 | Medium5.4 | — | 1.0% | Jul 31, 2024 |
21Monitor | CVE-2024-53999No exploit | Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionalityopensecurity · mobile security framework · CWE-79 | Medium5.4 | — | 0.5% | Dec 3, 2024 |
19Monitor | CVE-2025-24804No exploit | Partial Denial of Service (DoS) in MobSFopensecurity · mobile security framework · CWE-1287 | Medium4.8 | — | 0.4% | Feb 5, 2025 |
19Monitor | CVE-2026-24490No exploit | MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Fieldopensecurity · mobile security framework · CWE-79 | Medium4.8 | — | 0.3% | Jan 26, 2026 |
17Monitor | CVE-2024-31215No exploit | Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database checkopensecurity · mobile security framework · CWE-918 | Medium4.3 | — | 0.5% | Apr 4, 2024 |
5Monitor | CVE-2025-58161No exploit | MobSF Path Traversal in GET /download/<filename> using absolute filenamesopensecurity · mobile security framework · CWE-22 | Low1.3 | — | 0.8% | Sep 2, 2025 |
- CVE-2024-4339939Monitor
Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
CriticalCVSS 9.8No exploitEPSS 0%opensecurity · mobile security frameworkAug 19, 2024
- CVE-2025-3111639Monitor
Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding
CriticalCVSS 9.8No exploitEPSS 0%opensecurity · mobile security frameworkMar 31, 2025
- CVE-2025-2480534Monitor
Local Privilege Escalation in MobSF
HighCVSS 8.5No exploitEPSS 0%opensecurity · mobile security frameworkFeb 5, 2025
- CVE-2025-4633534Monitor
Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
HighCVSS 8.6No exploitEPSS 0%opensecurity · mobile security frameworkMay 5, 2025
- CVE-2025-2480333Monitor
Stored Cross-Site Scripting (XSS) in MobSF
HighCVSS 8.4No exploitEPSS 0%opensecurity · mobile security frameworkFeb 5, 2025
- CVE-2022-4154730Monitor
Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyze
HighCVSS 7.5No exploitEPSS 1%opensecurity · mobile security frameworkOct 18, 2022
- CVE-2023-4226130Monitor
Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions.
HighCVSS 7.5No exploitEPSS 0%opensecurity · mobile security frameworkSep 21, 2023
- CVE-2024-2919030Monitor
MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
HighCVSS 7.5No exploitEPSS 0%opensecurity · mobile security frameworkMar 22, 2024
- CVE-2024-5400030Monitor
Mobile Security Framework (MobSF) bypass of SSRF fix
HighCVSS 7.5No exploitEPSS 0%opensecurity · mobile security frameworkDec 3, 2024
- CVE-2025-5816226Monitor
MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
MediumCVSS 6.5No exploitEPSS 0%opensecurity · mobile security frameworkSep 2, 2025
- CVE-2025-4673026Monitor
Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
MediumCVSS 6.5No exploitEPSS 0%opensecurity · mobile security frameworkMay 5, 2025
- CVE-2026-3354526Monitor
MobSF has SQL Injection in its SQLite Database Viewer Utils
MediumCVSS 6.5No exploitEPSS 0%opensecurity · mobile security frameworkMar 26, 2026
- CVE-2024-4195521Monitor
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
MediumCVSS 5.4Proof of conceptEPSS 1%opensecurity · mobile security frameworkJul 31, 2024
- CVE-2024-5399921Monitor
Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
MediumCVSS 5.4No exploitEPSS 0%opensecurity · mobile security frameworkDec 3, 2024
- CVE-2025-2480419Monitor
Partial Denial of Service (DoS) in MobSF
MediumCVSS 4.8No exploitEPSS 0%opensecurity · mobile security frameworkFeb 5, 2025
- CVE-2026-2449019Monitor
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
MediumCVSS 4.8No exploitEPSS 0%opensecurity · mobile security frameworkJan 26, 2026
- CVE-2024-3121517Monitor
Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check
MediumCVSS 4.3No exploitEPSS 0%opensecurity · mobile security frameworkApr 4, 2024
- CVE-2025-581615Monitor
MobSF Path Traversal in GET /download/<filename> using absolute filenames
LowCVSS 1.3No exploitEPSS 0%opensecurity · mobile security frameworkSep 2, 2025