CVE-2023-43955

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.

• CWE-94

• https://github.com/actuator/com.phlox.tvwebbrowserExploit, Third Party Advisory
• https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/CWE-94.mdExploit, Third Party Advisory
• https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/poc.apkExploit, Third Party Advisory
• https://github.com/truefedex/tv-bro/pull/182#issue-1901769895Issue Tracking
• https://github.com/actuator/com.phlox.tvwebbrowserExploit, Third Party Advisory
• https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/CWE-94.mdExploit, Third Party Advisory
• https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/poc.apkExploit, Third Party Advisory
• https://github.com/truefedex/tv-bro/pull/182#issue-1901769895Issue Tracking

Published

Dec 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4394A use-after-free flaw was found in btrfs_get_dev_args_from_p…6
• CVE-2023-43944A Stored Cross Site Scripting (XSS) vulnerability was found …5.4
• CVE-2023-4395Cross-site Scripting (XSS) - Stored in GitHub repository coc…5.4
• CVE-2023-43951SSCMS 7.2.2 was discovered to contain a cross-site scripting…5.4
• CVE-2023-43952SSCMS 7.2.2 was discovered to contain a stored cross-site sc…5.4
• CVE-2023-43953SSCMS 7.2.2 was discovered to contain a cross-site scripting…5.4
• CVE-2023-43956Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
• CVE-2023-43958An arbitrary file upload vulnerability in the component /jqu…9.8
• CVE-2023-43959An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote …8.8
• CVE-2023-43960An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote att…8.8
• CVE-2023-43961An issue in Dromara SaToken version 1.3.50RC and before when…8.8
• CVE-2023-43962Cross Site Scripting vulnerability in Xunrui CMS Public Edit…4.8