CVE-2025-5154

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5154
A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The attack needs to be performed locally. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The root-requirement of the attack is reflected by the CVSS vector attribute PR:H. The vendor explains: "[A]s per the PoC this vulnerability needs a rooted device to exploit. PhonePe does not consider vulnerabilities found in rooted device as valid because there is not real-world exploit scenario."

2.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.4 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:M/C:P/I:N/A:N

Exploitability : 2.5 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://drive.google.com/drive/folders/1Xj9y2w3E98IZu8PUeGGI0nQPNsvVm87I?usp=sharing Not Applicable
https://github.com/honestcorrupt/-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched- Exploit
https://vuldb.com/cve/CVE-2025-5154
https://vuldb.com/submit/576245
https://vuldb.com/vuln/310242
https://vuldb.com/vuln/310242/cti
https://github.com/honestcorrupt/-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched- Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:phonepe:phonepe:25.03.21.0:*:*:*:*:android:*:*
History

07 Oct 2026, 07:16

Type Values Removed Values Added
References
  • {'url': 'https://vuldb.com/?ctiid.310242', 'tags': ['Permissions Required', 'VDB Entry'], 'source': 'cna@vuldb.com'}
  • {'url': 'https://vuldb.com/?id.310242', 'tags': ['Third Party Advisory', 'VDB Entry'], 'source': 'cna@vuldb.com'}
  • {'url': 'https://vuldb.com/?submit.576245', 'tags': ['Third Party Advisory', 'VDB Entry'], 'source': 'cna@vuldb.com'}
  • () https://vuldb.com/cve/CVE-2025-5154 -
  • () https://vuldb.com/submit/576245 -
  • () https://vuldb.com/vuln/310242 -
  • () https://vuldb.com/vuln/310242/cti -
Summary (en) A vulnerability, which was classified as problematic, was found in PhonePe App 25.03.21.0 on Android. Affected is an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. (en) A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The attack needs to be performed locally. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The root-requirement of the attack is reflected by the CVSS vector attribute PR:H. The vendor explains: "[A]s per the PoC this vulnerability needs a rooted device to exploit. PhonePe does not consider vulnerabilities found in rooted device as valid because there is not real-world exploit scenario."
Information

Published : 2025-05-25 19:15

Updated : 2026-10-07 07:16

NVD link : CVE-2025-5154

Mitre link : CVE-2025-5154

CVE.ORG link : CVE-2025-5154

JSON object : View

Products Affected

phonepe

  • phonepe
CWE
CWE-312

Cleartext Storage of Sensitive Information

CWE-313

Cleartext Storage in a File or on Disk