GCVE - cpe:2.3:a:eddyverbruggen:cordova_social_sharing:6.0.4:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:eddyverbruggen:cordova_social_sharing:6.0.4:*:*:*:*:node.js:*:*

part: a version: 6.0.4 update: *

Vendor	Eddyverbruggen (`a4a7335e-3621-53d2-876f-8ffe423ef72b`)
Product	Cordova Social Sharing (`8b0c5656-340a-5b6f-a01f-d58196bf2f08`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-65835`	vulnerable	2026-06-08 07:39:21.013313	Details available The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null. If a broadcast is sent with extras present but without EXTRA_CHOSEN_COMPONENT, the code dereferences a null value and throws a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application on the device can send crafted ACTION_SEND broadcasts to this component and repeatedly crash the host application, resulting in a local, unauthenticated application-level denial of service for any app that includes the plugin. Published: 2025-12-15T00:00:00.000Z Updated: 2025-12-15T19:31:22.320Z Open on db.gcve.eu Reference links https://github.com/EddyVerbruggen/SocialSharing-PhoneGap-Plugin https://www.npmjs.com/package/cordova-plugin-x-socialsharing https://medium.com/@lcrawfqrd/local-dos-via-exported-receivers-f6b1da10d3b7	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.