Log in Start free

Vulnerability · Published May 25, 2025 · Assigned by VulDB

CVE-2025-5154PhonePe App SQLite Database databases cleartext storage in file

Low 2.3

In plain English

A low-severity security flaw in PhonePe App. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)2.3Low
Exploit odds (30 days)0.2%top 91.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The attack needs to be performed locally. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The root-requirement of the attack is reflected by the CVSS vector attribute PR:H. The vendor explains: "[A]s per the PoC this vulnerability needs a rooted device to exploit. PhonePe does not consider vulnerabilities found in rooted device as valid because there is not real-world exploit scenario."

Affected products (as reported)

VendorProductVersions
n/a PhonePe App 25.03.21.0

Weakness: CWE-313, CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References