CVE-2025-5154

A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The attack needs to be performed locally. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The root-requirement of the attack is reflected by the CVSS vector attribute PR:H. The vendor explains: "[A]s per the PoC this vulnerability needs a rooted device to exploit. PhonePe does not consider vulnerabilities found in rooted device as valid because there is not real-world exploit scenario."

• CWE-312
• CWE-313
• CWE-312

• https://drive.google.com/drive/folders/1Xj9y2w3E98IZu8PUeGGI0nQPNsvVm87I?usp=sharingNot Applicable
• https://github.com/honestcorrupt/-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched-Exploit
• https://vuldb.com/cve/CVE-2025-5154
• https://vuldb.com/submit/576245
• https://vuldb.com/vuln/310242
• https://vuldb.com/vuln/310242/cti
• https://github.com/honestcorrupt/-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched-Exploit

Published

May 25, 2025

Last Modified

Oct 7, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51532Incorrect access control in Sage DPW 2024_12_004 and earlier…7.5
• CVE-2025-51533An Insecure Direct Object Reference (IDOR) in Sage DPW v2024…5.3
• CVE-2025-51534A cross-site scripting (XSS) vulnerability in Austrian Archa…8.1
• CVE-2025-51535Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as …9.1
• CVE-2025-51536Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as …9.8
• CVE-2025-51539EzGED3 3.5.0 contains an unauthenticated arbitrary file read…5.3
• CVE-2025-51540EzGED3 3.5.0 stores user passwords using an insecure hashing…5.3
• CVE-2025-51541A stored cross-site scripting (XSS) vulnerability exists in …6.1
• CVE-2025-51543An issue was discovered in Cicool builder 3.4.4 allowing att…9.8
• CVE-2025-5155A vulnerability has been found in qianfox FoxCMS 1.2.5 and c…8.8
• CVE-2025-5156A vulnerability was found in H3C GR-5400AX up to 100R008 and…9.8
• CVE-2025-51567A SQL Injection was found in the /exam/user/profile.php page…9.1