CVE-2024-3128

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android. This issue affects some unknown processing of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-258869 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The vendor was contacted early and responded very quickly. He does not intend to maintain the app anymore and will revoke the availability in the Google Play Store.

• CWE-530

• https://github.com/ctflearner/Android_Findings/blob/main/Replify-Messenger/Backup.md
• https://vuldb.com/?ctiid.258869
• https://vuldb.com/?id.258869
• https://vuldb.com/?submit.307761
• https://github.com/ctflearner/Android_Findings/blob/main/Replify-Messenger/Backup.md
• https://vuldb.com/?ctiid.258869
• https://vuldb.com/?id.258869
• https://vuldb.com/?submit.307761

Published

Apr 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31274Missing Authorization vulnerability in WPDeveloper EmbedPres…5.3
• CVE-2024-31275Missing Authorization vulnerability in Metagauss EventPrime.…9.8
• CVE-2024-31276Missing Authorization vulnerability in WPFactory Products, O…9.8
• CVE-2024-31277Deserialization of Untrusted Data vulnerability in PickPlugi…8.7
• CVE-2024-31278Insertion of Sensitive Information Into Sent Data vulnerabil…6.5
• CVE-2024-31279Cross-Site Request Forgery (CSRF) vulnerability in Catch Plu…5.4
• CVE-2024-31280Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8
• CVE-2024-31281Missing Authorization vulnerability in andy_moyle Church Adm…6.3
• CVE-2024-31282URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2024-31283Missing Authorization vulnerability in zorem Advanced Local …9.8
• CVE-2024-31284Missing Authorization vulnerability in WPDeveloper EmbedPres…9.8
• CVE-2024-31285Cross-Site Request Forgery (CSRF) vulnerability in Tooltip W…7.1