App Builder
Monthly
Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.8.7. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the `zipx.Unzip` routine. A crafted archive containing a symlink entry `ss` pointing to an external victim file and a subsequent regular-file entry `ß` causes the builder to follow the symlink - because APFS folds `ß` to `ss` - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.8.7. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.