Vulnerability · Published Aug 8, 2025 · Assigned by VulDB

CVE-2025-8707Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application components

Medium 5.3

In plain English

A medium-severity security flaw in Box App from Huuge. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xml of the component com.huuge.game.zjbox. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Huuge	Box App	1.0.3

Weakness: CWE-926 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-319137 | Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application components vdb-entry
VDB-319137 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #619858 | Paulet team Huuge Box(com.huuge.game.zjbox) 1.0.3 Task Hijacking third-party-advisory
https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md related
https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md#steps-to-reproduce exploit